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TORSION SUBGROUPS OF RATIONAL ELLIPTIC CURVES OVER THE 
COMPOSITUM OF ALL CUBIC FIELDS 

HARRIS B. DANIELS, ALVARO LOZANO-ROBLEDO, FILIP NAJMAN, AND ANDREW V. SUTHERLAND 


Abstract. Let E/Q be an elliptic curve and let Q(3°°) be the compositum of all cubic extensions 
of Q. In this article we show that the torsion subgroup of E( Q(3°°)) is finite and determine 20 
possibilities for its structure, along with a complete description of the Q-isomorphism classes of 
elliptic curves that fall into each case. We provide rational parameterizations for each of the 16 
torsion structures that occur for infinitely many Q-isomorphism classes of elliptic curves, and a 
complete list of ©invariants for each of the 4 that do not. 


1. Introduction 

Interest in the rational points on elliptic curves dates back at least to Poincare, who in 1901 
conjectured that the group E(Q) of rational points on an elliptic curve E over Q is a finitely 
generated abelian group [35]. This conjecture was proved by Mordell [32] in 1922 and then vastly 
generalized by Weil [44], who proved in 1929 that the group of rational points on an abelian variety 
defined over a number field is finitely generated. An immediate consequence of the Mordell-Weil 
theorem is that the torsion subgroup E(F) t ors of an elliptic curve E over a number field F is finite, 
and therefore isomorphic to a group of the form 

Z/aZ © Z/a5Z, 

for some integers a,b > 1. In 1996, Merel [31] proved the existence of a uniform bound on the 
cardinality of E(F) t ors that depends only on the number held F, not the particular elliptic curve 
E/F ; in fact, Merel’s bound depends only on the degree of the held extension Fj Q. This bound was 
improved and made effective by Oesterle in 1994 (unpublished), and later by Parent [34] in 1999. 

It is thus a natural goal to classify (up to isomorphism), the torsion subgroups of elliptic curves 
defined over number helds of degree d, for hxed integers d > 1. Mazur famously proved such a 
classihcation for d = 1. 


Theorem 1.1 (Mazur [28]). Let E/Q be an elliptic curve. Then 

f Z/MZ with 1 < M < 10 or M = 12, or 

E(Q) tors ^ “ 

v ' [Z/2Z © Z/2MZ with 1 < M < 4. 

The classihcation for d = 2 was initiated by Kenku and Mornose, and completed by Kamienny. 
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Theorem 1.2 (Kenku, Momose [22], Kamienny [16]). Let E/F be an elliptic curve over a quadratic 
number field F. Then 

with 1 < M < 16 or M = 18, or 
with 1 < M < 6, or 

with M = 1 or 2, only if F = Q(V~ 3), or 
only if F = 

The case d = 3 remains open. Jeon, Kim, and Schweizer have determined the torsion structures 
that appear infinitely often as one runs through all elliptic curves over all cubic fields [15], and Jeon, 
Kim, and Lee have constructed infinite families of elliptic curves that realize each of these torsion 
structures [12]. 

Theorem 1.3 (Jeon, Kim, Lee, Schweizer [12, 15]). Suppose that T is an abelian group for which 
there exist infinitely many <Q)-isomorphism classes of elliptic curves E over cubic number fields F , 
such that E(F)tors — T. Then 

T,jM7L with 1 < M < 16 or M = 18, 20, or 

Z/2Z © Z/2MZ with 1 < M < 7. 

Moreover, for each such T an explicit infinite family of elliptic curves over cubic fields with torsion 
subgroup isomorphic to T is known that contains infinitely many Q -isomorphism classes. 



E(F )tors ^ < 


'Z/MZ 

Z/2Z © Z/2MZ 
Z/3Z © Z/3MZ 
Z/4Z © Z/4Z 


A similar list of possible torsion structures that appear infinitely often as one runs through all 
elliptic curves over all quartic fields was determined by Jeon, Kim and Park [14] and infinite families 
of elliptic curves that realize each of these torsion structures were constructed by Jeon, Kim, and 
Lee [13]. 

Sharper results can be proved if one restricts to base extensions of elliptic curves that are defined 
over Q. In this setting the second author has obtained bounds on the largest prime-power order that 
may appear in a torsion subgroup [25, 27], and the third author has classified the torsion subgroups 
that can arise over extensions of degrees 2 and 3 [33]. Chou [2] has classified the groups that can 
appear when base-extending to a Galois quartic extension of Q. 


Theorem 1.4. [33, Thm. 2] Let E/Q be an elliptic curve and let F be a quadratic number field. 
Then 


E{F) 


'Z/MZ 

Z/2Z © Z/2MZ 
Z/3Z © Z/3MZ 
^Z/4Z © Z/4Z 


with 1 < M < 10 or M = 12,15,16, or 
with 1 < M < 6, or 
with 1 < M < 2 and F = Q(\/—3), or 
with F = Q(y/— 1). 


Theorem 1.5. [33, Thm. 1] Let E/Q be an elliptic curve and let F be a cubic number field. Then 


E{F) to rs ^ 


Z/MZ 

Z/2Z © Z/2MZ 


with 1 < M < 10 or M = 12,13,14,18, 21, or 
with 1 < M < 4 or M = 7. 


Moreover, the elliptic curve 1Q2B1 ewer Q(([ 9 ) + is the unique rational elliptic curve over a cubic field 
with torsion subgroup isomorphic to h/2YL. For all other groups T listed above there are infinitely 
many Qt-isomorphism classes of elliptic curves E/Q for which E{F) ~ T for some cubic field F. 
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In the setting of base extensions of elliptic curves E/ Q, one may also consider the torsion sub¬ 
groups that can arise over certain infinite algebraic extensions of Q. In general these need not be 
finite, and there may be infinitely many possibilities; but for suitably chosen extensions, this is not 
the case. For example, Ribet proved that for an abelian variety defined over a number field F, the 
torsion subgroup of its base change to the maximal cyclotomic extension of F is finite [36] . Here we 
consider infinite extensions obtained as the compositum of all number fields of a fixed degree d. 


Definition 1.6. For each fixed integer d > 1, letQ{d°°) denote the compositum, of all field extensions 
F/Q of degree d. More precisely, let Q be a fixed algebraic closure of Q, and define 

Q(d°°) :=Q({/3€Q :[Q(/3):Q] = 4). 

The fields Q(d°°) have been studied by Gal and Grizzard [10], who use the notation (they 
also consider the fields = QMqI 3 ! • • • and show that = Q^ precisely when d < 5). For 
elliptic curves E/Q, the group E(Q(d°°)) is not finitely generated. This was proved for d = 2 by 
Frey and Jarden [7] in 1974, and the result for d > 2 follows from the inclusion Q(2°°) C Q(d°°) 
given by [10, Theorem 1]. 

The torsion subgroups of E(Q(d°°)) have been studied in the case d = 2, in which the field Q(2°°) 
is the maximal elementary abelian 2-extension of Q. Even though E(Q( 2°°)) is not finitely generated, 
the torsion subgroup E(Q(2°°))t 0 rs is known to be finite, and the possible torsion structures have 
been classified by Laska and Lorenz [23], and Fujita [8, 9]. 


Theorem 1.7 (Laska, Lorenz [23], Fujita [8, 9]). Let E/Q be an elliptic curve and let 

Q(2°°) :=Q({V^:m€Z}). 


The torsion subgroup E( Q(2°°)) tors is finite, and 


E( Q(2°°)) to rs =* 


Z/MZ 

Z/2Z©Z/2 MZ 
< Z/3Z©Z/3Z 
Z/4Z® Z/4MZ 
Z/2MZ © Z/2MZ 


with M £ 1,3, 5, 7,9,15, or 
with 1 < M < 6 or M = 8, or 
or 

with 1 < M < 4, or 
with 3 < M <4. 


In this article we classify the torsion subgroups E(Q(3°°))tors that arise for elliptic curves E/Q. 
Our main theorem is the following. 


Theorem 1.8. Let E/Q be an elliptic curve. The torsion subgroup E(Q( 3°°))tors is finite, and 


E{ Q(3°°))tors ^ 


'Z/2Z0Z/2MZ 
Z/4Z0Z/4MZ 
Z/6Z © Z/6.MZ 
> Z/2MZ © Z/2MZ 


with M = 1,2,4,5,7,8,13, or 
with M = 1,2,4, 7, or 
with M = 1,2, 3,5, 7, or 
with M = 4, 6, 7,9. 


All but 4 of the torsion subgroups T listed above occur for infinitely many Q-isomorphism classes of 
elliptic curves E/Q; for T = Z/4ZxZ/28Z, Z/6ZxZ/30Z, Z/6ZxZ/42Z, and Z/14ZxZ/14Z there 
are only 2, 2, 4, and 1 (respectively) Q-isomorphism classes of E/Q for which E , (Q(3 00 ))tors — T. 
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Remark 1.9. Minimal conductor examples of elliptic curves E/Q that realize each of the torsion 
subgroups permitted by Theorem 1.8 are listed in the table below. Here and throughout we identify 
elliptic curves over Q by their Cremona label [3] and provide a hyperlink to the corresponding entry 
in the L -functions and Modular Forms Database (LMFDB) [24]. 


E/Q 

E(Q( 3°°))tors 

E/Q 

E(Q( 3°°)) t ors 

lla2 

Z/2Z0Z/2Z 

338al 

Z/4Z © Z/28Z 

17a3 

Z/2Z0Z/4Z 

20al 

Z/6Z © Z/6Z 

15a5 

Z/2Z©Z/8Z 

30al 

Z/6Z © Z/12Z 

Hal 

Z/2Z © Z/10Z 

14a3 

Z/6Z © Z/18Z 

26bl 

Z/2Z © Z/14Z 

50a3 

Z/6Z © Z/30Z 

210el 

Z/2Z © Z/16Z 

162bl 

Z/6Z © Z/42Z 

147bl 

Z/2Z © Z/26Z 

15al 

Z/8Z © Z/8Z 

17al 

Z/4Z © Z/4Z 

30a2 

Z/12Z © Z/12Z 

15a2 

Z/4Z © Z/8Z 

2450al 

Z/14Z © Z/14Z 

210e2 

Z/4Z © Z/16Z 

14al 

Z/18Z © Z/18Z 


Magma [1] scripts to verify these examples, and all other computational results cited herein, are 
available at [5]. These include explicit models of the modular curves we constructed in the course 
of proving our theorems, two algorithms to compute K(Q(3°°))tors for an elliptic curve E/Q (one is 
described in §5.5 and the other is an effective version of Theorem 7.1), and an implementation of 
the computational strategy that is used to prove Theorem 7.1, which precisely characterizes the sets 
of elliptic curves that realize each of the subgroups listed in Theorem 1.8, and in particular, which 
are finite and which are infinite. 

For each of the torsion structures T in Theorem 1.8 that arises infinitely often we provide a 
complete set of rational functions that parameterize the j-invariants of the elliptic curves E/Q for 
which £(Q(3°°))tor S contains a subgroup isomorphic to T (for the general member of each family, 
isomorphism holds), and for those that occur only finitely often we provide a complete list of j- 
invariants; this information appears in Table 1 at the end of the article. 

Key to our results are a number of recent advances in our explicit understanding of Galois rep¬ 
resentations attached to elliptic curves over number fields. In particular, we rely on work of Rouse 
and Zureick-Brown [38] classifying the 2-adic representations of elliptic curves over Q, work of Zy- 
wina [46] on the possible mod-p representations of an elliptic curve over Q, and algorithms developed 
by the fourth author [42] for efficiently computing the images of Galois representations of elliptic 
curves over number fields. 

Acknowledgements. The authors would like to thank Robert Grizzard for helpful conversations 
about the structure of Gal(Q(3°°)/Q) and Jackson Morrow, Jeremy Rouse, David Zureick-Brown, 
and David Zywina, for their computational assistance, including explicit models for some of the 
modular curves that appear in this article. We also thank Lukas Pottmeyer and David Zureick- 
Brown for their feedback on an early draft of this article. 

2. Notation and terminology 

We fix once and for all an algebraic closure Q that contains all the algebraic extensions of Q that 
we may consider, including the fields Q(d °°) and the Galois closure and algebraic closure of every 
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number field. As usual, for an elliptic curve E/F, we use E[n\ to denote the n-torsion subgroup 
of E(F), where F = Q when F is a number field. We recall that E[n ] ~ Z/nZ ® Z/nZ, so long 
as n is prime to the characteristic of F, which holds for all the cases we consider. If L/F is a field 
extension, we write E(L)[n] for the n-torsion subgroup of E{L), and for primes p, we write E(L)(p) 
for the p-primary component of E(L). For any point or set of points V in E(F), we write F(V) for 
the extension generated by the coordinates of V and F(x(V)) for the extension generated by the 
x-coordinates of V (we assume E is given by a Weierstrass equation in x and y). 

For an elliptic curve E/F, an n-isogeny is a cyclic isogeny ip: E —>• E' of degree n; this means 
ker p is a cyclic subgroup of E[n\, and as all the isogenies we consider are separable, this cyclic group 
has order n. The isogenies <p that we consider are also rational, meaning that ip is defined over F, 
equivalently, that ker <p is Galois-stable : the action of Ga \{F/F) on E[n] given by its action on the 
coordinates of the points P G E[n\ permutes ker ip C E[n\. To avoid any possible confusion, we will 
usually state the rationality of ip explicitly. We consider two (separable) isogenies to be distinct 
only when their kernels are distinct (otherwise they differ only by an isomorphism). 

We recall that if E/Q is an elliptic curve, then for each positive integer n the action of the group 
Gal(Q/Q) on the Z/nZ-module E[n\ induces a Galois representation (continuous homomorphism) 

p E ,n ■ Gal(Q/Q) ->■ Aut (E[n\) ~ GL 2 (Z/nZ), 

whose image we view as a subgroup of GL 2 (Z/nZ) (determined only up to conjugacy). When 
n = p is prime, we may identify GL 2 (Z/pZ) with GL 2 (F P ). The extension Q(_E[n])/Q is Galois, 
and the homomorphism Gal(Q(£ , [n])/Q) —>• GL 2 (Z/nZ) induced by restriction is injective; thus 
Gal(Q(£'[n])/Q) is isomorphic to a subgroup of GL 2 (Z/nZ). This subgroup necessarily contains 
elements of every possible determinant (each residue class in (Z/nZ) x contains the norms of infin¬ 
itely many unramified primes of Q(if[n])/Q), and an element 7 with trace 0 and determinant —1 
(corresponding to complex conjugation ). 1 We refer the reader to [39] for further background on 
Galois representations. 

We distinguish two standard subgroups of GL 2 (Z/nZ) (up to conjugacy): (1) the Borel group 
of upper triangular matrices, and (2) the split Cartan group of diagonal matrices. Recall that an 
elliptic curve E/Q admits a rational n-isogeny if and only if the image of pE,n in GL 2 (Z/nZ) is 
conjugate to a subgroup of the Borel group (both conditions hold if and only if E[n\ contain a 
Galois-stable cyclic subgroup of order n). Similarly, E/Q admits two rational n-isogenies whose 
kernels intersect trivially if and only if the image of pe,u in GL 2 (Z/nZ) is conjugate to a subgroup 
of the split Cartan group. 

If if is a subgroup of GL 2 (Z/nZ) with surjective determinant map that contains —1, we use Xu 
to denote the associated modular curve over Q whose non-cuspidal rational points parameterize 
elliptic curves E/Q for which the image of pu, n in GL 2 (Z/nZ) is conjugate to a subgroup of H. 
Certain information about Xu, including its genus, can be determined from the congruence subgroup 
Tu of PSL 2 (Z) obtained by taking the inverse image of the intersection of H with SL 2 (Z/nZ) in 
PSL 2 (Z) = SL 2 (Z)/{±1}. The tables of Cummins and Pauli [4] contain data for all congruence 
subgroups of genus up to 24 in which subgroups are identified by labels of the of the form “mX 9 ”, 
where m is the level, g is the genus, and X is a letter that distinguishes groups of the same level 


^he element 7 also must act trivially on a maximal cyclic subgroup of Z/nZ © Z/nZ corresponding to the real 
line, an additional constraint that is important when n is even; see Remark 3.14 in [42]. 
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and genus. We note that the level m of divides but need not equal n, and two non-conjugate 
H\ and H 2 may give rise to the same congruence subgroup Thx = T h 2 hi PSL 2 (Z). 

3. The field Q(3°°) 

As noted in the introduction, the field Q(2°°) C Q(3°°) is the maximal elementary abelian 2- 
extension of Q; the number fields in Q( 2 °°) are precisely those whose Galois group is isomorphic 
to (Z/2Z) n for some integer n > 0. In this section we similarly characterize the number Helds in 
Q(3°°) in terms of their Galois groups. 

Definition 3.1. We say that a finite group G is of generalized S^-type, if it is isomorphic to a 
subgroup of a direct product S 3 x ■ ■ ■ x S 3 of symmetric groups of degree 3. 

Recall that a finite group G is supersolvable (or supersoluble) if it has a normal cyclic series; 
an equivalent criterion is that every maximal subgroup of G has prime index [11], or that every 
subgroup of G is Lagrangian (each subgroup H contains subgroups of every order dividing \H\) [45]. 
The following lemma characterizes finite groups of generalized 53 -type. 

Lemma 3.2. A finite group G is of generalized S 3 -type if and only if (i) G is supersolvable, (ii) the 
exponent of G divides 6, and (in) the Sylow subgroups of G are abelian. 

Proof. For the forward implication, properties (i), (ii), and (iii) are all preserved by taking direct 
products and subgroups (and quotients). Thus to show that every finite group G of generalized 
5 3 -type has all three properties, it is enough to note that S 3 does, which is clearly the case. 

For the reverse implication, suppose that G is a finite group with properties (i), (ii), and (iii). 
Then G is supersolvable, so it has a cyclic normal series whose successive quotients have non¬ 
increasing prime orders (see [37, Thm. 5.4.8], for example), and since G has abelian Sylow subgroups 
and exponent dividing 6, we can write this series as 

1 <] (01) <1 • • • <4 (<7l, . . . , a m ) < (ct 1, . . . ,C7 m ,Tl) < ■ ■ ■ < (or, . . . ,<7 s ,Tl, . . . , T n ) = G 

where each aj has order 3, each r,; has order 2, the aj commute, and so do the r*. Conjugation 
by any r* fixes both (a 1 ,..., (Jj) and (01, • • • &j+ 1 ) — (01, ..., afi x (aj + i), and therefore (crj+ 1); it 
follows that for each r* and aj, either r, and aj commute or TiajTfi 1 = aJ 1 . 

If we now consider an n x m matrix (a^) over F 2 with a t] = 1 if and only if r,; and a :j do not 
commute, by row-reducing this matrix so that each column has at most one nonzero entry, we can 
construct a new basis {r{,... , r^} for the 2-Sylow subgroup of G with the property that each aj 
commutes with all but at most one t[. We can then write G in the form 

(1) G ~ (Z/3Z ) S0 x ((Z/3Z) Sl x Z/2Z) x • • • x ((Z/3Z) S " x Z/2Z), 

where So is the number of zero columns and Sj is the number of nonzero entries in the zth row of 
the reduced matrix (possibly s t = 0). It is then clear from (1) that G is isomorphic to a subgroup 
of the product of so + • • • + s n copies of S 3 , hence of generalized 53 -type. □ 

Example 3.3. The alternating group A 4 , the cyclic group Z/4Z, and the Burnside group 5(2,3) 
(the unique non-abelian group of order 27 and exponent 3) are examples of groups that are not of 
generalized 53 -type; each satisfies only two of the three properties required by Lemma 3.2. 

Corollary 3.4. The product of two groups of generalized S 3 -type is of generalized S 3 -type, as is 
every subgroup and every quotient of a group of generalized S 3 -type. 
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Our main goal in this section is to show that the groups that arise as Galois groups of number fields 
in Q(3°°) are precisely the groups of generalized 53-type. We first address the forward implication. 

Theorem 3.5. Let L be a number field, in Q(3°°) with Galois closure L. Then L C <Q)(3°°) and 
Gal(L/Q) is of generalized S^-type. In particular, the exponent o/Gal(L/Q) divides 6. 

Proof. Every number field L in Q(3°°) lies in a compositum of cubic fields F\ ■ ■ ■ F m . The composi- 
tum of the Galois closures F\ ■ ■ ■ F m is a Galois extension F/Q that contains L, and therefore L, 
and it is a subfield of Q(3°°), since we can write each i 7 ) = Fi iFj ^F,^ as a compositum of cubic 
fields Fi j := Q (otj) generated by the roots aj of an irreducible cubic polynomial defining Fi/Q. 
Each Gi := Gal(Ej) is isomorphic to either Z/3Z or S 3 , both of which are of generalized 53 -type, 
Gal(F/Q) is isomorphic to a subgroup of G\ x • • • x G m , hence of generalized 53 -type, and Gal(L/Q) 
is isomorphic to a quotient of Gal(E/Q), hence also of generalized 53 -type, by Corollary 3.4. □ 

We now prove the converse of Theorem 3.5. 

Theorem 3.6. Let L be a number field with Galois closure L, and suppose that Gal(L/Q) is of 
generalized S^-type. Then L C L C Q(3°°). 

Proof. From the proof of Lemma 3.2, if Gal(L/Q) is of generalized 53 -type then, as in (1), we have 

Gal(L/Q) ~ (Z/3Z) s ° x ((Z/3Z) S1 x Z/2Z) x • • • x ((Z/3Z) S " x Z/2Z). 

It follows that L is a compositum of linearly disjoint Galois extensions Fq, ... ,F n of Q for which 

Gal(F 0 /Q) ~ (Z/3Z) s ° and Gal(Fj/Q) ~ (Z/3Z) Si x Z/2Z 

for 1 < i < n. It suffices to show F t C Q(3°°) for 0 < i < n. Note that Fq is the compositum of 
cyclic (Galois) cubic extensions of Q, so Fq C Q(3°°). It remains to show that if F/ Q is Galois and 

Gal(F/Q) ~ ((Z/3Z ) s x Z/2Z) 

for some s > 0, then F C Q(3°°). Let Gal(F/Q) = ({r, (T 3 : 1 < j < s}), where t 2 = aj = 1, and 
TGjT~ l = eh -1 , and put 

H],k = (WjT, <Ti : 1 < i < S, ifi j }) 

for j = 1,..., s, and k = 0,1, 2. Each Hj ^ is a subgroup of Gal(E/Q) of order 2 • 3 S_1 , and if Kj ^ 
is the subfield of F fixed by Hj then [Kj^ : Q] = 3. Moreover, the extension Kj = Kj^Kj \ K 3 2 
is Galois over Q (because Gal{F/Kj) = ({cj : 1 < i < s, i / j }) is normal in Gal (F/Q)) with 
Gal(iLj/Q) ~ S 3 . Since F = K\- ■ ■ K s , it follows that 

S 

/•' ][/',.(, A,. 1 A,.2 

3 =1 

is a compositum of cubic fields and therefore lies in Q(3°°). □ 

We will appeal to Theorems 3.5 and 3.6 repeatedly in the sections that follow; for the sake of 
brevity we do not cite them in every case. 

We conclude this section by determining the roots of unity (f n of prime-power order n that he 
in Q(3°°). The possible values of n are severely constrained by the fact that if Q n € Q(3°°), then 
the exponent of Gal(<Q>(£n)/Q) — (Z/nZ) x must divide 6. 
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Lemma 3.7. Let n be a prime power. Then Q(( n ) C Q(3°°) if and only if n € {2,3,4, 7, 8,9}. 

Proof. Suppose Q(( n ) C Q(3°°). Then the exponent A(n) of Gal((Q)(C n )/Q) — (Z/raZ) x divides 6. 
We have A(2 e ) = 2 e_2 and A (p e ) = tp(p e ) = (p—\)p e ~ l for primes p > 2. It follows that A(n) divides 6 
only for n € {2, 3,4, 7,8, 9}. The group (Z/nZ) x is abelian, hence it is supersolvable and has abelian 
Sylow subgroups. Lemma 3.2 and Theorem 3.6 imply Q(( n ) C (Q>(3°°) for n € {2,3,4, 7, 8,9}. □ 

4. Finiteness Results 

Our goal in this section is to prove that L(Q(3°°))tors is finite. The only property of Q(3°°) that 
we actually require is that it is a Galois extension of Q that contains only a finite number of roots 
of unity, a property that applies to all the fields Q(d°°). We thus work in a more general setting. 

Theorem 4.1. Let E /Q he an elliptic curve and let F be a (possibly infinite) Galois extension ofQ 
that contains only finitely many roots of unity. Then E(F) tors is finite. Moreover, there is a uniform 
bound B, depending only on F, such that f/E(F)t ors < B for every elliptic curve E/Q. 

Before proving the theorem we first establish some intermediate results. We begin with the usual 
consequence of the existence of the Weil pairing. 

Proposition 4.2. [40, Ch. Ill, Cor. 8.1.1] Let E/L be an elliptic curve with L C Q. For each 
integer n > 1, if E[n] C E(L ) then the nth cyclotomic field Q(Cn) is a subfield of L. 

This immediately implies the following result. 

Lemma 4.3. Let E and F be as in Theorem f.l. Then E[n ] C E(F) for only finitely many n. 

The following theorem summarizes results of Mazur and Kenku that yield a complete classification 
of the rational n-isogenies that can arise for elliptic curves over (Q) (recall that n-isogenies are defined 
to be cyclic). See [25, §9] for further details. 

Theorem 4.4. [29, 18, 19, 20, 21] Let E/Q be an elliptic curve with a rational n-isogeny. Then 

n < 19 or n <E {21, 25, 27, 37,43,67,163}. 

Theorem 4.4 limits the primes p for which E(F)(p\ can be cyclic. 

Lemma 4.5. Let E and F be as in Theorem f.l. If E{F)[p\ has order p then p < 163. 

Proof. The group H = E(F)[p\ is stable under the action of Gal(F/Q), hence Galois-stable. If 
\H\ = p, then H is the kernel of a rational p-isogeny and p < 163, by Theorem 4.4. □ 

Lemmas 4.3 and 4.5 together imply that for any elliptic curve E/Q, the p-torsion subgroup of 
E(F ) is trivial for all but finitely many primes p, and E\p k ] C E(F ) for only finitely many prime 
powers p k . It remains only to check that the cyclic prime-power torsion of E(F ) is finite. 

Lemma 4.6. Let E and F be as in Theorem f.l, let p be a prime, and let k be the largest integer 
for which E[p k ] C E(F). If E(F)t OIS contains a subgroup isomorphic to r L/p kr L@ r L/pj r L with j > k, 
then E admits a rational pf^ k -isogeny. Moreover, j — k < 4, 3, 2, if p = 2, 3, 5, respectively, 
j — k < 1 if p = 7,11,13,17,19,43, 67,163, and j = k otherwise. 
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Proof. Let Q G E(F) be a point of order p 7 , and choose P G E[p> ] so that {P, Q} is a Z/fdZ-basis 
for E\p>], If cr G Gal(Q/Q), then a(Q) G E(F), because F is Galois, and a(Q) is a point of order p 7 . 
Thus a(Q) G E\p>\, so cr(Q) = aP + bQ for some integers a and b. 

We claim that a = 0 mod p 7_fc . Indeed, the equality a(Q) = aP + bQ implies that 

aP = a(Q) - bQ £ E(F), 

and if t is the p-adic valuation of a, then aP G L^p 7-4 ] and { aP,p t Q } C E(F) is a Z/p 7_4 Z-basis 
for Elp 3-1 ']. By the definition of k, we must have j — t < k, so j — k < t. Thus a = 0 mod p 7 - , as 
claimed, and we may write a = a'p>~ k for some integer a'. 

Let Qj-k ■= p k Q G E(F). We claim that (Qj_ k ) is Gal(Q/Q)-stable. Indeed, we have 

a(Qj_ k ) = a(p k Q ) = p k a(Q) = p k (aP + bQ) = p k ( a'p>~ k P + bQ) = a'p>P + bp k Q = bQ^_ k , 

for any a G Gal(Q/Q). Thus (Qj- k ) is a Galois-stable cyclic subgroup of E(F) of order pi~ k , and 
E —>• E/(Qj- k ) is a rational p 7 ' -fe -isogeny. The bounds on j — k then follow from Theorem 4.4. □ 

Proof of Theorem f.l. To show that E(F)t ors is finite, it suffices to show that (1) E(F) tors has a 
non-trivial p-primary component for only finitely many primes p, and (2) for each of these primes p, 
the p-primary component of E(F) tors is finite. 

(1) Let n be the maximum of 163 and the largest order of a root of unity in F, and let p > n 
be prime. Then E[p\ E(F), by Lemma 4.3, so if the p-primary component of E(F) tors is 
non-trivial, it must be cyclic, and in this case Lemma 4.5 implies that p < 163 < n, which 
is a contradiction. So the p-primary part of E(F) t0 r S is trivial for all p > n. 

(2) Let p < n be prime and let k be the largest integer for which Q(£ *,) C F. It follows from 
Lemma 4.6 that the cardinality of the p-primary part of E(F) t ors is bounded by p 2fc+4 . 

The integer n and the maximum value of k over primes p < n depend only on F, as does the bound 
on E(F) tors- This concludes the proof of Theorem 4.1. □ 

Lemma 3.7 allows us to apply Theorem 4.1 with F = Q(3°°); more generally, we have the following 
proposition. 

Proposition 4.7. For every d> 2 the cardinality of E(Q(d°°)) tors is finite and uniformly bounded 
as E varies over elliptic curves over Q. 

Proof. It follows from [10, Prop. 10] that for any finite Galois extension K/Q in Q(d°°)), the exponent 
of Gal(Lf/(Q)) is bounded. Indeed, K is a subfield of a conrpositum of degree-d fields, and Gal(iL/Q) 
is isomorphic to a quotient of a subgroup of a direct product of transitive groups of degree d, each 
of which has exponent dividing the exponent A (Sd) of the symmetric group Sd- For all sufficiently 
large prime powers p k , the exponent A (p k ) > p k / 4 of Gal(Q(C p fc)/Q) is larger than A (Sd), implying 
that ( p k (L Q(d°°). The proposition then follows from Theorem 4.1. □ 

We now make this result more precise in the case d = 3 by determining the primes p for which 
L'(Q(3 00 ))(p) can be non-trivial. We first note the following lemma. 

Lemma 4.8. Let E/Q be an elliptic curve that admits a rational n-isogeny ip, and let P G E[n\ be 
a point of order n in the kernel of ip. The field extension Q(P)/Q generated by the coordinates of P 
is Galois and Gal(Q(P)/Q) is isomorphic to a subgroup of (Z/n7j) x . In particular, if n is prime 
then Gal(Q(P)/Q) is cyclic and its order divides n — 1. 
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Proof. The fact that <p is rational implies that (P) is a Galois-stable subgroup of E[n\. It follows 
that Q(P)/Q is Galois: every Galois conjugate of a coordinate of P is necessarily a coordinate of 
some aP £ (P), all of which lie in Q(P) because E (and therefore the group law on E) is defined 
over Q. The homomorphism Gal(Q(P)/Q) —>• (Z/nZ) x given by a i —> a, where cr(P) = aP, is 
injective, since if <r(P) = t(P) then ar~ 1 (P) = P, and this implies cjt^ 1 = 1 fixes Q(P). □ 

Proposition 4.9. Let E/Q be an elliptic curve, and let p be a prime dividing the cardinality of 
E(Q( 3°°))tors. Then p £ {2, 3,5, 7,13}. 

Proof. For primes p > 11, Lemma 3.7 implies that Q(3°°) does not contain a primitive pth root 
of unity, and therefore E\p\ $7 <Q>(3°°), by Proposition 4.2. If p > 17 with p / 37,43,67,163, then 
Lemma 4.6 implies that P(Q(3°°))[p] is trivial. 

For the primes p = 11,17,37,43,67, and 163, if the p-primary part H of F'(Q(3 00 )) tors is not 
trivial then it must be cyclic of order p, in which case E admits a rational p-isogeny with a point 
P £ i7(Q(3 00 ))[p] of order p in its kernel. By Lemma 4.8, the group Gal(Q(P)/Q) is cyclic, and it 
follows from Theorems 6.2 and 9.4 of [25] that its order is at least (p — l)/2 for p 37, and at least 
(p — l)/3 = 12 for p = 37. In each case, the exponent of Gal(Q(P)/Q) cannot divide 6, and therefore 
Q(P) $7 Q(3°°), by Theorem 3.5. But this contradicts P £ P(Q(3°°)), so in fact P(Q(3°°))[p] must 
be trivial for all p > 11 except possibly p = 13. The proposition follows. □ 

As can be seen by the examples in Remark 1.9, all the values of p permitted by Proposition 4.9 
actually do arise for some E/Q. Lemmas 3.7 and 4.6 imply explicit bounds on the prime powers p k 
that can divide P(Q(3°°))tors (namely, k < 10, 7, 2, 3,1 for p = 2,3, 5, 7,13, respectively), but as we 
will show in the next section, these bounds are not tight. 

5. Maximal ^-primary components of P(Q(3°°)) tors 

In this section we obtain sharp bounds on the p-primary components of E( Q(3°°)) for elliptic 
curves E/Q. We will prove the following theorem. 

Theorem 5.1. Let E/Q be an elliptic curve. Then P(Q(3°°))tors is isomorphic to a subgroup of 

T max := (Z/8Z © Z/16Z) 0 (Z/9Z 0 Z/9Z) © Z/5Z 0 (Z/7Z 0 Z/7Z) 0 Z/13Z, 

and T max is the smallest group with this property. 

In order to prove the theorem it suffices to address the p-primary components F7(Q(3°°))(p) for 
each of the primes p = 2,3,5, 7, 13 permitted by Proposition 4.9. We first prove two preliminary 
results that will be used in the subsections that follow. We recall that the Q-isomorphism class of 
an elliptic curve E/Q may be identified with its j-invariant j(E). 

Proposition 5.2. Let E/Q be an elliptic curve with j(E) 1728. The isomorphism type of 
E(Q(3°°))toTs depends only on the Q-isomorphism class of E, equivalently, only on j(E). 

Proof. Recall that for j(E) / 0,1728, if j(E') = j(E) for some E'/Q then E' , is a quadratic twist of 
E, hence isomorphic to E over an extension of degree at most 2. If j(E) = 0 and j{E ') = j(E), then 
E'/Q is isomorphic to E over a cyclic extension of Q of order dividing 6 (see §X.5 of [40], for example). 
Thus for j(E) = j(E') 0, the elliptic curves E and E' are isomorphic over a field of generalized 

A.a-type, hence their base changes to Q(3°°) are isomorphic and E(Q( 3°°)tors — E'{ Q(3°°)) tors . □ 
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Remark 5.3. When j(E) = 1728 there are two possibilities: either A(Q(3°°))tors — Z/2Z©Z/2Z or 
^(Q(3°°))tors — Z/4Z©Z/4Z. These are realized by the elliptic curves 256bl and 32al, respectively. 

Lemma 5.4. Let p and q be distinct primes, let Ki/K\ be a finite Galois extension of number fields 
with [K 2 : K 1 ] a power of q, and let E be an elliptic curve defined over Q. 

(1) If E(Ki)\p\ = E(K 2 )\p], then E{K{)(jp) = E(K 2 ){p), that is, if the p-torsion of E does not 
grow when we move from K\ to K 2 , then neither does the p-primary torsion. 

(2) LetV = E(K 2 )\p\. Then E(Ki(V))(p) = E(K 2 )(p), that is, the p-primary torsion of E(K 2 ) 
stabilizes over the extension of K\ generated by the the p-torsion of E{K 2 ). 

Proof. We first note that (2) is implied by (1), since K\(V) has all the properties required of K\ 
(indeed, K\ C KfiV) C K 2 , so K 2 /K\(fP) and [ K 2 : K\{V)\ divides [K 2 : K\], so it is a power of q). 

To prove (1), we assume E(Ki)\p\ = E(K 2 )\p\, (1) clearly holds when this group is trivial, 
we assume otherwise. We now suppose for the sake of contradiction that E(K\)(p) is properly 
contained in E(K 2 )(p). Then there exists a point Q G E(K 2 )(p) for which P = pQ is a nonzero 
point in E(K\)(p ), say of order p k for some k > 1. Then R = p k ~ 1 P is a nonzero element of 
E(Ki)\p\ C E\p\, and we may choose S G E[p\ so that { R , S} is a Z/pZ-basis for E\p\. 

The multiplication-by-p map is a separable endomorphism of degree p 2 , so there are p 2 distinct 
preimages of P under multiplication by p (including Q); these are precisely the points in the set 

Q ■= [p] -1 (.P) = {Q + aR + bS : 0 < a, b < p}. 

Put Q 1 := Qf]E(Ki) and Q 2 := Qn E(K 2 ). Of the p 2 points in Q, at least p lie in E(K 2 ), namely, 
the points Q + aR (since Q,R G E(K 2 )), so Q 2 has cardinality at least p. If its cardinality is greater 
than p, then Q + aR + bS G E{K 2 ) for some b 0 mod p, which implies bS € E(K 2 ), and therefore 
S G E{K 2 ), since b is invertible modulo p and S has order p. Thus the cardinality of Q 2 is either p 2 
or p, depending on whether E(K 2 )\p\ = E\p\ or not. 

We claim that Q\ is empty. For the sake of contradiction, suppose Q + aR + bS € Q\ C E(K\). 
We then have Q + bS € E(K\), since R G E(K\), and since Q ^ E(K{) by assumption, we must have 
b ^ 0 mod p. This implies S G E(K 2 ), since Q, Q+bS G E(K 2 ). But then S G E{K 2 )\p\ = E(K{)\p\, 
so 5 G E(K\), which contradicts Q ^ E(K\), since Q + bS G E(K\). 

The Galois group Gal(iG 2 /Wi) acts on the set Q, since it is the solution set of pX = P, which is 
stable under Ga^A^/iti) because P G E(K\). The fact that Qi is empty implies that this action 
has no fixed points. By the orbit-stabilizer theorem, the size of each orbit divides | Gal(A' 2 /A'i)|, a 
power of the prime q , and since no orbit is trivial, the size of each orbit is divisible by q. It follows 
that the cardinality p 2 of Q is divisible by q, which is a contradiction, since p and q are distinct 
primes. Thus our supposition that E(K\)(p) E(K 2 )(p) must be false, which proves (1). □ 

5.1. Primes without the possibility of full p-torsion (p = 5,13). We start with the primes p 
for which E\p\ E( Q(3°°)), namely, p = 5,13. In these cases T?(Q(3°°))(p) is necessarily cyclic. 

Lemma 5.5. Let E/Q be an elliptic curve. Then E{ Q(3°°))(5) is either trivial or isomorphic 
to Z/5Z; the latter holds if and only if E admits a rational h-isogeny whose kernel generates an 
extension of degree at most 2. 

Proof. It follows from Lemma 3.7 and Proposition 4.2 that E[5\ % £'(Q(3 00 )), thus £ , (Q(3°°))(5) is 
cyclic of order for some j > 0. Lemma 4.6 implies, j < 2; we will show that in fact j < 1. Suppose 
for the sake of contradiction that E(Q( 3°°)) contains a point P of order 25. Let K := Q(P) C Q(3°°), 
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let K 2 C Q(3°°) be the Galois closure of K , and let K\ := A^nQ^ 00 ). Then [K 2 : Ad] is a power of 3, 
since Gal(Ad/Q) is of generalized 53 -type and Q(3 00 )/Q(2 00 ) is elementary 3-abelian. Theorem 1.7 
then implies that A(Ad)(5) C A(Q(2°°))(5) is either trivial or isomorphic to Z/5Z. 

Suppose first that A(Ad)(5) is trivial. The point P\ = 5 P € A^Ad) has order 5, but E[ 5] % A(Ad), 
since K 2 C A(Q(3°°)), so (Pi) C E(K 2 ) is Galois-stable and therefore the kernel of a rational 
5-isogeny. This implies that G := Gal(Q(Pi)/Q) is isomorphic to a subgroup of (Z/5Z) X , by 
Lemma 4.8. The group G cannot have order 4, because it is the Galois group of a number field 
in Q(3°°) and must have exponent dividing 6, by Theorem 3.5. On the other hand, G cannot 
have order 1 or 2, because then Pi would be defined over a quadratic extension, and therefore over 
K\ = K 2 O Q(2°°), contradicting our assumption that E(K i)(5) is trivial. 

We therefore must have E(K\){h) ~ Z/5Z, in which case A(ATi)[5] = E(K 2 )[5\ — Z/5Z, and we 
may apply Lemma 5.4 with p = 5 and q = 3. But then E(K\)( 5) = E(K 2 )(5), which contradicts 
our assumption that A(Ad) contains a point of order 25. So j < 1 as claimed and E{ Q(3°°))(5) 
is either trivial or isomorphic to Z/5Z. In the latter case P(Q(3°°))(5) is a Galois-stable cyclic 
subgroup of order 5 that is the kernel of a rational 5-isogeny. It follows from Lemma 4.8 that this 
kernel generates a cyclic extension K/Q whose degree divides 4, and in fact it must have degree 
2, since K C Q(3°°) implies that the exponent of Gal(A"/Q) divides 6. Conversely, if E admits a 
rational 5-isogeny whose kernel generates an extension K/Q of degree at most 2, then K C <Q>(3°°), 
by Theorem 3.6, in which case E{ Q(3°°))(5) — Z/5Z. □ 

Example 5.6. Any elliptic curve E/Q with a rational point of order 5 has P(Q(3°°))(5) ~ Z/5Z; 
the curve llal is an example. Another example is the curve 50a3, which has trivial rational 5-torsion 
but admits a rational 5-isogeny whose kernel generates an extension of degree 2. 

Lemma 5.7. Let E/Q be an elliptic curve. Then, P(Q(3°°))(13) is either trivial or isomorphic 
to Z/13Z; the latter holds if and only if E admits a rational 13-isogeny whose kernel generates an 
extension of degree dividing 6. 

Proof. It follows from Lemma 3.7 and Proposition 4.2 that P[13] % E(Q(3°°)), thus E(Q(3°°))) is 
cyclic of order 13- 7 for some j > 0, and Lemma 4.6 implies j < 1. The last statement follows from 
Lemma 4.8: the kernel of a 13-isogeny admitted by E generates a cyclic extension K/Q of degree 
dividing 12, and then K C Q(3°°) if and only [K : Q] divides 6, by Theorems 3.5 and 3.6. □ 

Example 5.8. The curve 147bl has P(Q(3°°)) ~ Z/13Z; its 13-division polynomial has a cubic 
factor, so it has a point of order 13 over an extension whose degree divides 6 (in fact, 3). 

5.2. Primes with the possibility of full p-torsion (p = 2, 3, 7). We now consider the primes 
p = 2,3,7 for which Q(3°°) contains a primitive pth root of unity (so E\p\ C P(Q(3°°)) is not 
immediately ruled out by the Weil pairing). In this subsection we address p = 2, 7; the case p = 3 
is addressed in the next subsection. 

Lemma 5.9. If E/Q is an elliptic curve, then E , (Q(3 00 ))[2] = E[ 2] ~ Z/2Z® Z/2Z. 

Proof. If we put E/Q in the form y 2 = f(x) with f(x) cubic, the non-trivial points in E[ 2] are 
precisely the points of the form (a, 0) with a a root of /, all of which lie in Q(3°°). □ 

Lemma 5.10. Let E/Q be an elliptic curve. If E{ Q)[2] is non-trivial then E(Q( 3°°))(2) is equal to 
E(Q( 2°°))(2); otherwise £ , (Q(3°°))(2) is equal to E[ 2] or E[ 4] and E(Q( 2°°))(2) is trivial. In either 
case, E{ Q(3°°)) is isomorphic to a subgroup o/Z/8Z©Z/8Z or Z/4Z © Z/16Z. 
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Proof. We first suppose that E(Q)[2] is non-trivial. Then E(Q(2°°))[2] is also non-trivial, and 
therefore -E(Q(2°°))[2] = E[ 2], by Theorem 1.7. Lemma 5.4 then implies that the 2-primary torsion 
cannot grow in any 3-power Galois extension of Q(E[2]). Since Q(E[2]) C Q(2°°) C Q(3°°), we must 
have E(Q( 3°°))(2) = E(Q(2°°))(2), and Theorem 1.7 then implies that E(Q(3°°))(2) is isomorphic 
to a subgroup of Z/ 8 Z 0 Z/ 8 Z or Z/4Z 0 Z/16Z. 

We now suppose that E(Q)[2] is trivial. Then E(Q(2°°))(2) is also trivial: if E: y 2 = f(x) 
has no rational points of order 2 then the cubic / must be irreducible, in which case every point 
of order 2 generates a field of degree 3. We also note that E cannot admit a rational 2-isogeny, 
since the unique point of order 2 in the kernel of such an isogeny would be Galois-stable, hence 
rational. Thus E does not admit a rational 2 J -isogeny for any j > 0; Lemma 4.6 then implies 
-E(Q(3°°))(2) ~ Z/2 fc Z x Z/2 fc Z for some k > 0, and Proposition 4.2 and Lemma 3.7 imply k < 3. 
To show k < 3, we note that an enumeration (in Magma) of the subgroups G of GL 2 (Z/ 8 Z) with 
surjective determinant maps finds that whenever G is of generalized 53 -type, it is actually elementary 
2-abelian. This implies that if Q(E[ 8 ]) C Q(3°°) then in fact Q(T?[ 8 ]) C Q(2°°), but we have assumed 
that E(Q[2]) is trivial, hence E( Q(2°°))(2) is trivial, so this cannot occur. □ 

Example 5.11. The elliptic curves 15al and 210 e 2 realize the maximal possibilities Z/ 8 Z 0 Z/ 8 Z 
and Z/4Z0 Z/16Z, respectively, for E(Q( 3°°))(2). 

Before addressing the 7-primary component of E(Q(3°°)), we prove a lemma that relates the 
degree of the p-torsion field Q(E[p]) of E/Q to the number of rational p-isogenies admitted by E 
(we consider two isogenies to be distinct only if their kernels are distinct). 

Lemma 5.12. Let E/Q be an elliptic curve and let p > 2 be a prime for which E admits a rational 
p-isogeny. Then [Q(E[p]) : Q] is relatively prime to p if and only if E admits two rational p-isogenies 
(with distinct kernels). For p > 5 this implies that p divides [Q(E[p]) : Q], 

Proof. The hypothesis implies that the image of pe, p is conjugate to a subgroup B of the Borel 
group in GL 2 (Z/pZ). Lemma 2.2 of [26] implies that B = B^B i where 

J) :&GZ/pzj, and := £ n |Y “ : a, c € (Z/pZ) x | . 

Thus the order of B ~ Gal(Q(E[p])/Q) is relatively prime to p if and only if B\ is trivial, equivalently, 
B = B<i is a subgroup of the split Cartan group, in which case E admits two rational p-isogenies 
with distinct kernels. However, as proved in [17], this can only occur for p < 5. □ 

Lemma 5.13. Let E/Q be an elliptic curve. Then E(Q( 3°°))(7) is isomorphic to a subgroup of 
7L/7T, 0 Z/7Z. The case E( Q(3°°))(7) ~ Z/7Z0Z/7Z occurs if and only if j(E) = 2268945/128, 
and the case E(Q( 3°°))(7) ~ Z/7Z occurs if and only if E admits a rational 7-isogeny, equivalently, 

, (f 2 + 13 1 + 49) (f 2 + 5t + 1) 

m = -- - -. 

for some t € Q x . 

Proof. Lemma 3.7 and Proposition 4.2 imply that E[49] (2 Q(3°°), and Lemma 4.6 then implies that 
E(Q(3°°))(7) ~ Z/7 fc Z 0 Z/7 J Z with k < 1, and k < j < k + 1. 

If j > k then Lemma 4.6 implies that E admits a rational 7-isogeny, and Lemma 5.12 then implies 
that [Q(E[7]) : Q] is divisible by 7. The exponent of Gal(Q(E[7])/<Q>) is therefore not divisible by 6 , 
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so Q(E[7]) $2 Q(3°°), therefore k = 0, j = 1, and E{ Q(3°°))(7) ~ Z/7Z. This also rules out the case 
k = 1 and j = 2 , which proves the first statement in the theorem. 

If j = k then we claim that E cannot admit a rational 7-isogeny. Indeed, if E admits a rational 
7-isogeny and P is a non-trivial point in its kernel, then Lemma 4.8 implies that Gal(Q(P)/Q) is 
cyclic of order dividing 6 , hence of generalized <S 3 -type, so Q(P) € Q(3°°), by Theorem 3.6. But 
then we must have j = k = 1, so Q(£'[7]) C Q(3°°), but then Lemma 5.12 implies that 7 divides 
[Q(E[7]) : Q], which contradicts Q(E[7]) C Q(3°°). Thus k = 0 ,j = 1 if and only if E admits a 
rational 7-isogeny, equivalently, j(E) lies in the image of the map from Xq( 7) to the j-line that 
appears in the statement of the lemma and can be found in [25, Table 3], for example. 

If j = k = 1 then <Q)(E[p]) C Q(3°°), so Gal(Q(E[p])/Q) has exponent dividing 6 , by Theo¬ 
rem 3.5. This implies that for every prime p / 7 of good reduction for E, the elliptic curve E p /¥ p 
obtained by reducing E modulo p has its 7-torsion defined over an F p -extension of degree dividing 
6 , and in particular, admits an F p -rational 7-isogeny (two in fact). Thus E/Q admits a rational 7- 
isogeny locally everywhere but not globally, and as proved in [41], this implies j(E) = 2268945/128. 
Conversely, as also proved in [41], for every elliptic curve E/Q with this j-invariant the group 
Gal(Q(E[7])/Q) is isomorphic to a subgroup of GL 2 (F 7 ) with surjective determinant map whose 
image in PGL 2 (F 7 ) is isomorphic to S 3 ; up to conjugacy there are exactly two such groups (labeled 
7NS.2.1 and 7NS.3.1 in [42]), and both are of generalized S 3 -type. Thus every elliptic curve E/Q 
with j(E) = 2268945/128 has £(Q(3°°))(7) ~ Z/7Z© Z/7Z. 

Otherwise, j = k = 0 and E(Q( 3°°))(7) is trivial; the lemma follows. □ 

Example 5.14. The curve 2450al has /-invariant 2268945/128 and is thus an example of an elliptic 
curve E/Q for which E(Q(3°°))(7) ~ Z/7Z © Z/7Z. 

Corollary 5.15. Let E/Q be an elliptic curve. Then E(Q( 3°°))tors — Z/14Z©Z/14Z if and only 
ifj(E) = 2268945/128. 

Proof. The forward implication is an immediate consequence of Lemmas 5.9 and 5.13. A direct 
computation of E(Q(3°°))(p) for p = 2, 3,5, 7, 13 for the elliptic curve 2450al in Example 5.14 finds 
that E(Q(3°°))tors = E[ 14] for this particular E/Q with j(E) = 2268945/128, hence for every E/Q 
with the same /-invariant, by Proposition 5.2. □ 

5.3. The 3-primary component of E(Q(3°°))tors- 

Lemma 5.16. Let E/Q be an elliptic curve. Then £ , (Q(3°°))[3] = E[ 3] if and only if E admits a 
rational 3-isogeny, and E( Q(3°°))(3) is trivial otherwise. 

Proof. An enumeration of the subgroups G of GL 2 (Z/ 3 Z) finds that G is of generalized S 3 -type if 
and only if it is conjugate to a subgroup of the Borel group; this implies the first part of the lemma, 
since E(Q(3°°))[3] = E[ 3] if and only if Gal(Q(E[3])/Q) ~ im pe,z C GL 2 (Z/ 3 Z) is of generalized 
S 3 -type. If Q(E[3]) % Q(3°°), then Lemma 4.6 implies that if E( Q(3°°))(3) is non-trivial then E 
admits a rational 3-isogeny, but this cannot occur, so E( Q(3°°))(3) is trivial. □ 

Lemma 5.17. Let E/Q be an elliptic curve. Then E(Q( 3°°)) does not contain a subgroup isomor¬ 
phic to Z/9Z © Z/27Z. 

Proof. Suppose for the sake of contradiction that there is an elliptic curve E/Q for which E( Q(3°°)) 
contains a subgroup isomorphic to Z/9Z©Z/27Z. Then the image G := im/ 5^27 1= GL2(Z/27Z) of 
the mod-27 Galois representation attached to E satisfies the following properties: 
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(i) G has a surjective determinant map and an element with trace 0 and determinant —1; 

(ii) G contains a normal subgroup N that acts trivially on a Z/27Z-submodule of Z/27 © Z/27 
isomorphic to Z/9Z © Z/27Z for which G/N is of generalized S^-type. 

As noted in §2, the first condition is required by pe,h for any elliptic curve E/Q. The second require¬ 
ment reflects the fact that Q(E[27]) contains the Galois extension Q(£ , (Q(3°°))[27])/Q whose Galois 
group is a quotient G/N of G and for which the Galois group Gal(Q(-E[27]/Q(£ , (Q(3°°))[27]) ~ N 
acts trivially on a subgroup of E[27] isomorphic to Z/9Z © Z/27Z. 

An enumeration in Magma of the subgroups of GL2(Z/27Z) finds that every such G is conjugate 
to a subgroup of the full inverse image of 

0 '(° “)■(« ?)) SGMZ/9Z) 

in GL2(Z/27Z). Taking the intersection of H with SL2(Z/9Z) shows that H corresponds to the 
congruence subgroup labeled 9H 1 in the tables of Cummins and Pauli [4], The modular curve Xh 
of level 9 and genus 1 is defined over Q and has 3 rational cusps (the number of rational cusps can 
be determined via [47, Lemma 3.4], for example). The group H is equal to the intersection H\ n H 2 
of two subgroups of GL2(Z/9Z) whose intersection with SL2(Z/9Z) gives the congruence subgroups 
91° and 9J°. Explicit rational parameterizations for the genus zero modular curves Xh 1 and Xjj 2 
appear in [43]; these curves both admit rational maps to Xo(3), allowing us to explicitly construct 
a rational model for Xh as the fiber product of these maps over Xo(3). This model is isomorphic 
to the elliptic curve 27a3, which has just 3 rational points, which is equal to the number of rational 
cusps on Xh, so there are no non-cuspidal rational points. It follows that for every elliptic curve 
E/Q, the image of pe, 27 is not conjugate to a subgroup of H , which is our desired contradiction. □ 

Proposition 5.18. If E/Q is an elliptic curve, then E{ Q(3°°)) does not have a point or order 27. 

Proof. Suppose for the sake of obtaining a contradiction that E/Q is an elliptic curve with a point 
of order 27 defined over Q(3°°). Lemmas 5.16 and 5.17 imply _E(Q(3°°))(3) ~ Z/3Z x Z/27Z. We 
now proceed as in the proof of Lemma 5.17, and consider the subgroups G of GL2(Z/27Z) that 
may arise as the image of the nrod-27 Galois image im pe, 27 , except in (ii) we now only require the 
normal subgroup N of G for which G/N is of generalized SVtype to act trivially on a submodule 
isomorphic to Z/3Z © Z/27Z. We find that every such G is conjugate to a subgroup of one of three 
subgroups Hi,H- 2 ,H^ C GL2(Z/27Z) whose intersection with SL2(Z/27Z) yields the congruence 
subgroups with Cummins-Pauli labels 27C 1 , 27B 4 , 27A 4 , respectively. We now show that no elliptic 
curve E/Q can have im pe .27 conjugate to a subgroup of any of the groups H\,H 2 , H 3 , which is our 
desired contradiction. 

The group H\ lies in the Borel subgroup of upper triangular matrices in GL2(Z/27Z), so if im pe ,27 
is conjugate to a subgroup of H 1 then E admits a rational 27-isogeny. From [25, Table 4] we see that 
there is just one Q-isomorphism class of elliptic curves that admit a rational 27-isogeny, represented 
by the curve 27a2. None of the four curves in its isogeny class 27a have ^-invariant 1728, so by 
Proposition 5.2, it is enough to check whether E(Q( 3°°)) contains a point of order 27 for each of 
the four curves E/Q in isogeny class 27a; a direct computation finds that none do. 

The group H 2 is conjugate to a subgroup of 



H a : = 


C GL 2 (Z/27Z), 
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whose intersection with SL(2,Z/27Z) is conjugate to 27A 2 . Using the methods of [38], Rouse and 
Zureick-Brown have computed a model for the corresponding modular curve Xh 4 of genus 2, which 
has two rational cusps: 

Xh 4 ■ y 2 = x e — 18x 3 — 27. 

A 2-descent on the Jacobian of this curve shows that it has rank zero, so the rational points on 
Xh a can be easily determined via Chabauty’s method (using the ChabautyO function in Magma, 
for example). The only points in are the 2 points at infinity, both of which must be cusps. 

This rules out the possibility that irn pe .27 is conjugate to a subgroup of i7 2 C h a . 

This leaves only the group 


h 3 -.= 



(0 J))cGL 2 (Z/27Z). 


Using the results of [43], a singular model for the modular curve Xh 3 can be explicitly constructed 
as the fiber product over Xo( 9 ) of two genus zero curves with maps f 3 and (t 3 — 6t 2 + 3t + 1 )/ (t 2 — t ) 
to Ao( 9 ) (the corresponding congruence subgroups are 27A° and 91 °, respectively). This yields the 
genus 4 curve 

X H3 : x 3 y 2 - x 3 y - y 3 + 6 y 2 - 3y = 1. 

which has two rational points at infinity (both singular). 

Over Q(( 3 ) the automorphism group of Xh 3 is isomorphic to Z/3Z © Z/3Z, and with a suitable 
choice of basis for Aut(A// 3 ) the two cyclic factors yield two distinct genus 2 quotients, corresponding 
to the curve 

C : y 2 = x 6 - 18C 3 z 3 - 27Cf 

and its complex conjugate C. The curve C is isomorphic to Xh 4 over Q(£g), consistent with the fact 
that the restriction of H 3 to elements with determinant 1 mod 9 is a subgroup of H4. A calculation 
by Jackson Morrow (see [5] for details) shows that the Jacobian of C has rank 0 and torsion subgroup 
of order 3 generated by the difference of the two points at infinity on C (and similarly for C). It 
follows that the only rational points on C and C are the points at infinity; pulling back these points 
to our model for Xh 3 yields only the two rational points at infinity, both of which correspond to 
cusps on Xh 3 ', this rules out the possibility that im pe ,27 is conjugate to a subgroup of H 3 . □ 


Having ruled out points of order 27 in E(Q(3°°)) t ors , we now give a necessary and sufficient 
criterion for E( Q(3°°))(3) to be maximal. 


Lemma 5.19. Let E/Q be an elliptic curve. Then E(<Q>( 3°°))(3) = i7[9] ~ Z/9Z0Z/9Z if and only 
if one of the following holds: 

(i) The image of pe ,3 is conjugate to a subgroup of the split Cartan subgroup of GL 2 (Z/3Z); 
equivalently, E admits two distinct rational 3-isogenies. This case occurs if and only if 


m 


27f 3 (8-f 3 ) 3 
(t 3 + l) 3 ’ 


for some t € Q, t / —1. 

(ii) The image of pe ,9 is conjugate in GL 2 (Z/9Z) to a subgroup of 



H : = 
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This case occurs if and only if 

432 t(t 2 - 9)(f 2 + 3) 3 (f 3 -9 1 + 12) 3 (f 3 + 9 1 2 + 27 1 + 3) 3 (5 1 3 - 9f 2 - 9t - 3) 3 
^ “ (: t 3 - 3f 2 - 9t + 3) 9 (f 3 + 3t 2 -9 1- 3) 3 

/or some t 6 Q. 

Proof. It is easy to verify that both H and the full inverse image of the split Cartan subgroup C of 
GL2(Z/3Z) in GL2(Z/9Z) are of generalized 53 -type; it follows that if the image of lies in C 
or if the image of pe ,9 lies in H, then pe ,9 gives an isomorphism from Gal(Q(E[9])/Q) to a group 
of generalized 53 -type and therefore Q(E[9]) C <Q>(3°°), so E(Q(3°°))[9] = E[9], 

An enumeration of the subgroups G C GL2(Z/9Z) of generalized 53 -type shows that either the 
image of G in GL2(Z/3Z) is conjugate to a subgroup of C , or G is conjugate to a subgroup of H. 
The groups C and H correspond to the congruence subgroups 3D° and 9J°, both of genus 0; the 
rational maps from Xq and Xjj to the /-line are taken from [43]. □ 

Example 5.20. The elliptic curve E/Q with Cremona label 27a3 admits two rational 3-isogenies, 
hence E(Q( 3°°))(3) — Z/9Z©Z/9Z. On the other hand, the curve 17100g2 admits only one rational 
3-isogeny but also has E(Q(3°°))(3) ~ Z/9Z © Z/9Z. 

Lemma 5.21. Let E/Q be an elliptic curve. Then E(Q( 3°°))(3) ~ Z/3Z © Z/9Z if and only if 
the image of pe ,9 in GL2(Z/9Z) is not of generalized S^-type and is conjugate in GL2(Z/9Z) to a 
subgroup of one of the following two groups: 



Equivalently, j(E) lies in the image of one of the rational maps 

■ 4" 3) 3 (t 3 + 9t 2 + 27t + 3) 3 . . . (t + 3)(f 2 — 3t + 9)(t 3 + 3) 3 

Jl{t) = - W +9 1 + 27)-’ J2{t) = - E -• 

Proof. It is easy to verify that neither H 1 nor H -2 are of generalized 53 -type (which rules out 
E(Q( 3°°))(3) — Z/9Z©Z/9Z), and that each contains a normal subgroup A/ for which the quotient 
Hi/Ni is of generalized 53 -type, and for which the image of IN/ in GL2(Z/3Z) is trivial and for which 
Ni acts trivially on an element of order 9 in Z/9Z©Z/9Z. This implies that if Gal(Q(E[9])/Q) — Hi 
then the base change of E to the field Ki C Q(3°°) corresponding to the normal subgroup of 
Gal(Q(E[9])/Q) isomorphic to N t has torsion subgroup that contains a subgroup isomorphic to 
Z/3Z © Z/9Z; moreover, E(Q( 3°°))(3) cannot be any larger than this because we have ruled out 
any points of order 27 in E(Q( 3°°)) (Proposition 5.18) and N t cannot be the trivial group. 

An enumeration of the subgroups of GL2(Z/9Z) shows that every group G that is not of gener¬ 
alized 53 -type and which contains a normal subgroup N satisfying all the properties of A/ above is 
either conjugate to a subgroup of Hi or H 2 , or is conjugate to a subgroup of 



with congruence subgroup 9A. As computed by Rouse and Zureick-Brown (using the techniques 
of [38]), the corresponding modular curve Xh 3 has genus 1 and is isomorphic to the elliptic curve 
27a3, which has just 3 rational points; two of these are cusps, while the other corresponds to j- 
invariant 0. But for every elliptic curve E/Q with /-invariant 0, we have E(Q°°)( 3) ~ Z/9Z©Z/9Z 
as can be verified by checking one example and applying Proposition 5.2. 
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The groups H\ and H 2 yield congruence subgroups 9B° and 9C°, respectively, both of genus zero; 
the maps j\(t) and 72 (t) to the j-line are taken from [43]. □ 

5.4. Proof of Theorem 5.1. Let E/Q be an elliptic curve. Proposition 4.9 shows that any prime 
divisor p of the order of L'(Q(3 00 ))tors lies in the set {2, 3,5, 7,13}. Lemma 5.10 (p = 2), Lemma 5.17 
and Proposition 5.18 (p = 3), Lemma 5.5 (p = 5), Lemma 5.13 (p = 7), and Lemma 5.7 (p = 13) 
together imply that E( Q(3°°))tors is isomorphic to a subgroup of 

T max = (Z/16Z © Z/8Z) © (Z/9Z © Z/9Z) © Z/5Z © (Z/7Z © Z/7Z) © Z/13Z. 

Examples 5.11, 5.20, 5.6, 5.14, 5.8 for p = 2,3,5, 7,13, respectively, show that T max is the smallest 
group with this property. □ 

5.5. An algorithm to compute the structure of £ , (Q(3 00 ))t 0 rs- With Theorem 5.1 in hand we 
can now sketch a practical algorithm to compute the isomorphism type of P(Q(3°°))tors for a given 
elliptic curve E/Q, which we may assume is defined by y 2 = /(x). The strategy is to separately 
compute each p-primary component E(Q(3°°))(p) for p = 2,3, 5, 7, 13 by first determining the largest 
integer k for which F(Q(3°°))[p fc ] = E\p k ] and then determining the largest integer j for which 
E(Q(3°°))(p) contains a point of order p 3 . 

Both steps make use of the division polynomials fE,n(%) whose roots are the distinct x-coordinates 
of the nonzero points P £ E[n\. The polynomials fE,n(x) satisfy well-known recurrence relations 
that allow them to be efficiently computed; see [30], for example. If m divides n then fE, n is 
necessarily divisible by /e ,™,, and roots of the polynomial fE,n/fE,m are the distinct x-coordinates 
of the points in E[n\ that do not lie in E[m\, by removing the factor fE,m of /e,u for each maximal 
proper divisor m of n one obtains a polynomial h E ^ n whose roots are the distinct x-coordinates of 
the points in E[n] of order n. 

The field Q (E[n\) is an extension of the splitting field Kf of fE,n(%) of degree at most 2 (the 
degree is 2 when im pe,u contains —1 € GL 2 (Z/nZ), and 1 otherwise, see [42, Lemma 5.17]). A 
necessary and sufficient condition for Q(E[n])) C Q(3°°) is that for every irreducible factor g of 
hE,n(x) with splitting Held K g , the field L g := K g (y/f(r)) is of generalized 53 -type, where /(x) is 
the cubic defining E : y 2 = /(x) and r is any root of g\ note that each field L g is of the form Q(P) 
for some P € E[n\ of order n and is necessarily a Galois extension of Q that contains the coordinate 
of every point in (P). A necessary and sufficient condition for E , (Q(3 00 ))t 0 rs to contain a point of 
order n is that for some irreducible factor g of h EtU (x) the field L g is of generalized 53 -type. 

We may thus compute E(Q(3°°))(p) as follows: 

• Determine the largest k for which E[p k ] C Q(3°°) by checking increasing values of k from 1 
up to the bound given by Theorem 5.1. For each k, compute the polynomial h Ep k , factor it 
over Q, and for each irreducible factor g compute the field L g and check whether Gal (L g /Q) 
is of generalized 53 -type (via Lemma 3.2) for all g. 

• Determine the largest j for which E(Q(3°°))(p) contains a point of order p 1 by checking 
increasing values of j from k up to the bound given by Theorem 5.1. For each k, compute 
the polynomial h E p j , factor it over Q, and for each irreducible factor g compute the field L g 
and check whether Gal(T s /Q) is of generalized 53 -type for some g. 

As written this algorithm is not quite practical, but there are two things that may be done to 
make it so. First, one can use a Monte Carlo algorithm to quickly rule out polynomials g whose 
splitting fields cannot be of generalized 53 -type by picking random primes and factoring the reduced 
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polynomial g over the corresponding finite field; if g has an irreducible factor whose degree does 
not divide 6 then the splitting field of g cannot be of generalized S 3 - type. The second practical 
improvement is to use the explicit criterion for j(E) given by Lemmas 5.13, 5.19, and 5.21 to more 
quickly compute the 3-primary and 7-primary components of £ , (Q(3°°))tors - 2 

A magma script implementing the algorithm with these optimizations can be found in [5]; it 
was used to determine the 20 examples of minimal conductor that appear in Remark 1.9. These 
examples prove that each of these cases arise; in the next section we prove that no others do. 

Remark 5.22. In Section 7 we obtain a complete list of parameterizations for each torsion structure 
E(Q( 3 00 ))tor S ; see Table 1. With this list in hand one can immediately determine L , (Q(3 00 ))t 0 rs from 
j{E) whenever j(E) 7 ^ 1728, making it unnecessary to use the algorithm sketched above, except for 
distinguishing the two possibilities when j(E) = 1728 (see Remark 5.3). However, the algorithm is 
implicitly used in several of the proofs in the next section that require us to explicitly check a finite 
number of cases, and our list of parameterizations depends on these results. (We did not use the 
algorithm to prove any of the results in this section; see [5] for details of our computations.) 

6. The Structure of E ( Q ( 3 °°)) t ors 

In this section we complete the classification of the torsion structures T ~ E( Q(3°°))tors that 
appear in Theorem 1.8. There are a total of 1008 isomorphism types T given by subgroups of 
the maximal group T max that appears in Theorem 5.1, of which 648 contain the minimal subgroup 
Z/2Z© Z/2Z required by Lemma 5.9, but we will prove that in fact only 20 occur as E{ Q(3°°))tors 
for some elliptic curve E/Q. In the five subsections that follow, for p = 13, 7, 5, 3, 2, we will prove 
that there are 1, 4, 2, 5, 8 (respectively) possibilities for T when p is the largest prime divisor of its 
cardinality, and determine these T explicitly. 

We begin with a lemma that allows us to distinguish the two possibilities for E{ Q(2°°))(2) per¬ 
mitted by Lemma 5.10 when i£(Q)[2] is trivial. For an elliptic curve E/Q, we use A (E) € Q x 
to denote its discriminant. We recall that for j(E) / 0,1728, the image of A (E) in Q x /Q x2 is 
determined by j(E) (see [40, Cor. 5.4.1]); in fact, 

(2) A (E) = j{E) - 1728 (in Q x /Q x2 ), 

as one can verify by computing the discriminant A (E) = — 16(4A 3 + 27 B 2 ) of the elliptic curve 
E : y 2 = x 3 + Ax + B with A = 3j(E)(1728 — j(E)) and B = 2j(E)(1728 — j(E )) 2 both nonzero. 

Lemma 6.1. Let E/Q be an elliptic curve for which i£(Q)[2] is trivial, but -E(Q(3°°))[4] = E[ 4]. 
Then —A(E) is a square in Q and 

—4(t 2 — 3) 3 (t 2 — 8 t — 11) 

m = - ww -’ 

for some t € Q \ {—1}. 

Proof. If _E(Q)[2]) is trivial and £ , (Q(3°°))[4] = E[4\ then the image G := imis conjugate to a 
subgroup of GL 2 (Z/ 4 Z) of generalized S^-type whose image in GL 2 (Z/ 2 Z) does not fix any nonzero 
element of Z/2Z©Z/2Z (equivalently, has order at least 3). As noted in §2, the group G must have 
a surjective determinant map and contain an element 7 corresponding to complex conjugation (here 

o 

We did not exploit this second improvement when using the algorithm to perform any of the explicit computations 
of E( Q(3°°))torH cited in §5, since this improvement depends on some of these computations. 
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we use the stronger criterion of [42, Rem. 3.15]). An enumeration of the subgroups of GL 2 (Z/4Z) 
finds that every such G is conjugate to a subgroup of 


H : = 




The corresponding modular curve Xh is labeled X20a in [38] and has genus zero. A map to the 
j-line is given by the rational function 

—4(t 2 — 3) 3 (f 2 — 8 t — 11) 

(t + l) 4 ' 

Since neither 0 nor 1728 lie in the image of the map j(t), from (2) we see that the discriminant Aft) 
of an elliptic curve over Q with j-invariant j(t) must satisfy 

A(t)=j{t)~ 1728 = -l (in Q x /Q x2 ), 


thus —A (t) is always a square, as claimed. 


□ 


6.1. When 13 divides #E(Q(3°°))tors- There is only one possibility for E( Q(3°°))tors when it 
contains a point of order 13. 

Proposition 6.2. Let E/Q be an elliptic curve for which E(Q( 3°°)tors contains a point of order 13. 
Then E{ Q(3°°))tors is isomorphic to Z/2Z©Z/26. 

Proof. By Lemma 5.7, E must admit a rational 13-isogeny, since -E(Q(3°°))(13) is non-trivial. Theo¬ 
rem 4.4 implies that E admits no other rational n-isogenies, and it follows that Q(3°°)(3), Q(5°°)(5), 
and Q(7°°)(7) are all trivial, by Lemma 5.16, Lemma 5.5, and Lemma 5.13 and Corollary 5.15, re¬ 
spectively. Since E admits no rational 2-isogenies, i£(Q)[2] is trivial, and Lemma 5.10 implies that 
E(Q( 3°°))(2) is isomorphic to either E[ 2] or E[ 4], By Lemma 6.1, if the latter holds then —A(E) is 
a rational square; we claim that this cannot occur. 

The modular curve Xo(13) that parameterizes 13-isogenies has genus 0 and yields a rational 
parameterization of the j-invariants of elliptic curves E/Q that admit a rational 13-isogeny. From 
[25, Table 3] we see that j(E) must lie in the image of the rational map 

(f 2 + 5i + 13) (t 4 + 71 3 + 20t 2 + 19t + l ) 3 
j(t) ■— t 

Neither 0 nor 1728 lie in the image of the map j(t), so by (2), the corresponding discriminant A(f) 
of an elliptic curve over Q with j-invariant j(t) must satisfy 

A (t) = ( j{t ) - 1728) 3 = t(t 2 + 6 t + 13) (in Q x /Q x2 ), 

with t 0. Finding t € Q x for which —A(t) € Q is a square is equivalent to finding nonzero rational 
points P on the elliptic curve 

Ea ■ V 2 = x(x 2 — 6 x + 13) 

for which x(P) 7 ^ 0, equivalently, P 0 -Ea(Q)[ 2]. But a calculation shows that E a has rank 0 and 
torsion subgroup isomorphic to Z/2Z, so no such P exists. □ 

Remark 6.3. One can obtain infinitely many elliptic curves E/Q with Fl(Q(3 00 ))tors — Z/2Z©Z/26 
and distinct j-invariants by choosing E for which E(F) ~ Z/13Z for some cubic field F, as shown 
in [33]. The curve 147bl is an example F = Q[x]/(x 3 + x 2 — 2x — 1). 
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6.2. When 7 divides ffE(Q(3 00 ))t 0 rs- We now address the cases where ffE(Q(3°°))i OTS is divisible 
by 7 (but not 13). The case where it is also divisible by 49 is already covered by Lemma 5.13, and 
Corollary 5.15, which imply that we then must have -F(Q(3°°))tors — Z/14Z©Z/14Z. Theorem 4.4 
and Lemma 5.13 then leave us just 3 possibilities to consider: (1) E admits a rational 21-isogeny, 
(2) E admits a rational 14-isogeny, (3) E admits a rational 7-isogeny and no others. These are 
addressed in the next three lemmas. Recall that if E admits a rational m-isogeny p and a rational 
n-isogeny ip, with m and n coprime, then it necessarily admits a rational mn- isogeny, namely, the 
isogeny E —>• E/( ker p, ker ip). 

Lemma 6.4. Let E/Q be an elliptic curve. Then E admits a rational 21-isogeny if and only if 
E(Q( 3°°))tors - Z/6Z © Z/42Z. 

Proof. It follows from Lemmas 5.13 and 5.16 that if E{ Q(3°°))tors — Z/6Z©Z/42Z, then E admits 
a rational 7-isogeny and a rational 3-isogeny, hence a rational 21-isogeny. From [25, Table 4] we 
see that there are just four Q-isomorphism classes of elliptic curves E/Q that admit a rational 
21-isogeny, represented by the four elliptic curves in the isogeny class with Cremona label 162b. A 
direct computation finds that -E?(Q(3°°))tors ~ Z/6Z © Z/42Z for each of these four curves. □ 

Lemma 6.5. Let E/Q be an elliptic curve. If E admits a rational 14 -isoqeny then £YQ(3°°))tors is 
isomorphic to Z/2Z © Z/14Z. 

Proof. From [25, Table 4] we see that there are just two Q-isomorphism classes of elliptic curves E/Q 
that admit a rational 14-isogeny, represented by the curves 49al and 49a2. A direct computation 
finds that -E?(Q(3°°))tors — Z/2Z © Z/14Z for both curves. □ 

Lemma 6.6. Let E/Q be an elliptic curve. If E admits a rational 7-isogeny and no other non-trivial 
rational n-isogenies, then E( Q(3°°))tors is isomorphic to Z/2Z©Z/14Z or Z/4Z © Z/28Z. 

Proof. Lemmas 5.16, 5.5, and 5.7 imply that E(Q(3°°))(p) is trivial for p = 3,5,13, and Lemma 
5.10 implies that E( Q(3°°))(2) = E[ 2] or E[ 4], □ 

We summarize the results of this subsection in the following proposition. 

Proposition 6.7. Let E/Q be an elliptic curve for which E( Q(3°°))tors contains a point of order 7. 
Then E(Q(3°°))tois is isomorphic to one of the groups: Z/2Z©Z/14Z, Z/4Z©Z/28Z, Z/6Z©Z/42Z, 
Z/14Z © Z/14Z. 

Proof. This follows from Corollary 5.15 and Lemmas 6.4, 6.5, 6.6. □ 

6.3. When 5 divides #£ : (Q(3 00 ))t 0 rs- We now address the cases where #-E(Q(3 00 ))t 0 rs is divisible 
by 5 (but not 7 or 13). 

Lemma 6.8. Let E/Qbe an elliptic curve. If E admits a rational 15-isogeny then E{ Q(3°°))tors is 
isomorphic to Z/6Z©Z/6Z or Z/6Z©Z/30Z (both occur). If E( Q(3°°))t 0 rs — Z/6Z©Z/30Z then 
E admits a rational 15-isogeny. 

Proof. As can be seen in [25, Table 4], there are four Q-isomorphism classes of elliptic curves 
E/Q that admit a rational 15-isogeny, represented by the four curves in isogeny class 50a. A 
direct computation finds that F?(Q(3°°))t ors ~ Z/6Z © Z/6Z for the curves 50al and 50a2, while 
£(Q(3°°))tors ~ Z/6Z© Z/30Z for the curves 50a3 and 50a4. It follows from Lemmas 5.5 and 5.16 
that if E{ Q(3°°))tors — Z/6Z © Z/30Z then E admits a rational 5-isogeny and a rational 3-isogeny, 
hence a rational 15-isogeny. □ 
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Proposition 6.9. Let E/Q be an elliptic curve for which E(Q( 3°°)) contains a point of order 5 
Then E( Q(3°°))tors is isomorphic to Z/2Z©Z/10Z or Z/6Z © Z/30Z. 

Proof. As noted above, the results of the previous two subsections imply that E(Q(3°°))tors is not 
divisible by 7 or 13. Lemma 5.5 implies that E admits a rational 5-isogeny, and if E{Q{ 3°°))(3) is 
non-trivial, then E also admits a rational 3-isogeny, by Lemma 5.16, in which case it falls into the 
case covered by Lemma 6.8. We know that E(Q( 3°°))(5) ~ Z/5Z, by Lemma 5.5, thus it remains 
only to consider E( Q(3°°))(2) when E(Q(3°°))(p) is trivial for p = 3, 7,13. 

We first suppose that I7(Q)[2] is non-trivial. Then E( Q(3°°))(2) = E(Q( 2°°))(2), by Lemma 5.10. 
Lemma 5.5 implies that E( Q(3°°))(5) = E{ Q(2°°))(5), since E must admit a rational 5-isogeny 
whose kernel generates and extension of degree at most 2, hence a subfield of Q(2°°). Theorem 1.7 
then implies E(Q(3°°)) toIS = E(Q( 2°°)) tors ~ Z/2Z © Z/10Z. 

We now suppose that i?(Q)[2] is trivial. Then E(Q( 2°°)) is trivial and E{ Q(3°°)) = E[ 2] or E[4\, 
by Lemma 5.10. Lemma 6.1 implies that the latter holds only when —A (E) is a rational square. We 
claim that this cannot occur. From [25, Table 3], we see that since E admits a rational 5-isogeny, 
its j-invariant must lie in the image of the rational map 

(t 2 + 10t + 5)=> 

m =- - t -. 

Neither 0 nor 1728 lie in the image of this map, so by (2), the discriminant A(f) of an elliptic curve 
over Q with ^-invariant j(t) must satisfy 

A (t) = (. j{t) - 1728) 3 = t(t 2 + 22 1 + 125) (in Q x /Q x2 ), 

with t 0. Finding t € (Q) x for which —A (t) is a square is equivalent to finding rational points P 
on the elliptic curve 

E A . y 2 = x(x 2 - Tlx + 125) 

that do not lie in F?a(Q)[ 2]. But we find that F'a(Q) — Z/2Z, so no such P exist. Thus we must 
have E(Q( 3°°))(2) = E[ 2], and therefore E(Q( 3°°))tors — Z/2Z © Z/10Z. □ 

6.4. When only 2 and 3 divide #E( Q(3°°)). We now consider the case where #-E(Q(3°°))tors 
is divisible by 3 but not by 5, 7, or 13. Lemmas 5.9 and 5.16 imply 77(Q(3°°))[6] = E[ 6], thus if 
E(Q( 3°°)) does not cannot contain any points of order 24 or 36, then Theorem 5.1 implies that 
7^(Q(3°°)) tors must be isomorphic to one of the five groups 

(3) Z/6Z © Z/6Z, Z/6Z © Z/12Z, Z/6ZffiZ/18Z, Z/12Z©Z/12Z, Z/18Z©Z/18Z. 

As shown by the examples in Remark 1.9, these cases all occur for some E/Q, so it suffices to show 
that E( Q(3°°)) cannot contain any points of order 24 or 36. 

Proposition 6.10. Let E/Q be an elliptic curve. There are no points of order 24 in E(Q( 3°°)). 

Proof. Suppose E(Q( 3°°)) contains a point of order 24; then it contains both a point of order 3 and a 
point of order 8. Lemma 5.16 implies that E admits a rational 3-isogeny, and the points in the kernel 
of this 3-isogeny are defined over a quadratic extension (by Lemma 4.8), so E{ Q(2°°)) contains a 
point of order 3. Lemma 5.10 implies that i?((Q>)[2] is non-trivial and £ , (Q(3°°))(2) = E(Q(1°°))(2), 
so E(Q( 2°°)) contains a point of order 8. But then E( Q(2°°)) contains a point of order 24, which 
contradicts Theorem 1.7. □ 


In order to rule out a point of order 36 in E(Q( 3°°)) we require the following lemmas. 
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Lemma 6.11. Let E/ Q be an elliptic curve. If E(Q) contains a point of order 2, and E{ Q(3°°)) 
contains a point of order 4, then either £'(Q)[2] = E[ 2] or E admits a rational 4-isogeny. 

Proof. It suffices to consider the possible images G C GL 2 (Z/ 4 Z) of pe,a- An enumeration of the 
subgroups G of GL 2 (Z/ 4 Z) finds that whenever the image of G in GL 2 (Z/ 2 Z) fixes a nonzero element 
of Z/2Z0Z/2Z (i.e. E{Q) contains a point of order 2) and G contains a normal subgroup N for which 
G/N is of generalized S 3 - type and N fixes an element of order 4 in Z/4Z 0 Z/4Z (i.e. E{ Q(3°°)) 
contains a point of order 4), then either the image of G in GL 2 (Z/ 2 Z) is trivial (F1(Q)[2] = E[ 2 ]) or 
G stabilizes a cyclic subgroup of 'Ll XL 0 Z/4Z of order 4 ( E admits a rational 4-isogeny). □ 

Lemma 6.12. Let E /Q be an elliptic curve that admits a rational 9-isogeny. Then E{Q{ 3°°)) does 
not contain a point of order 4. 


Proof. If if(Q)[2] = Efl] then E is isogenous to an elliptic curve that admits a rational 4-isogeny 
and a rational 9-isogeny, hence a rational 36-isogeny, which is ruled out by Theorem 4.4. If £'(Q)[2] 
has order 2 then E{ Q(3°°)) cannot contain a point of order 4, because E would then admit a rational 
4-isogeny, by Lemma 6.11, hence a rational 36-isogeny, which is again ruled out by Theorem 4.4. 

We are thus left to consider the possibility that F?(Q)[2] is trivial and E(Q( 3°°)) has a point of 
order 4, in which case Lemma 5.10 implies £ , (Q(3°°))[4] = E[ 4], and Lemma 6.1 implies that —A (E) 
is a square. We can assume j(E) / 0 because a direct computation shows that for the curve 27a3 
with j(E) = 0 we have E{ Q(3°°))tors — Z/18Z 0 Z/18Z, which does not contain a point of order 4. 
Proposition 5.2 implies that this is true for every E/Q with j{E) = 0. 

From [25, Table 3] we see that j(E) must lie in the image of the rational map 


j(t) 


t 3 (t 3 - 24) 3 
t 3 - 27 


Having ruled out j{E) = 0, we can assume j(t) / 0 (so t / 0), and 1728 does not lie in the image 
of j{t). so by (2), for any t / 0,3 the discriminant A(f) of an elliptic curve with j-invariant j(t) 
satisfies 

A(t) = {j{t) - 1728) 3 = {t- 3 ){t 2 0 3t + 9) (in Q x /Q x2 ). 

To see whether —A (t) can be square when t 7 ^ 0,3, we search for nonzero rational points P with 
x(P) 7 ^ 0,3 on the elliptic curve 

Ea ■ y 2 = {x + 3)(x 2 - 3x + 9). 


We find that L'a(Q) — Z/2Z, and the nonzero rational point has x-coordinate 3. Thus no such P 
exist and the lemma follows. □ 


Lemma 6.13. Suppose that E/Q admits just one rational 3-isogeny and no rational 9-isogenies, 
and that E{ Q(3°°)) contains a point of order 9. Then 

_ (t + 3)(t 2 -3 1 + 9 ){t 3 + 3 ) 3 
J{ } t 3 

for some t € Q x . 

Proof. To determine the possible images of the mod-9 Galois representation of an elliptic curve E/Q 
satisfying the hypothesis of the proposition, we conducted a search similar to that used in the proof 
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of Lemma 5.17, using Magma to enumerate the subgroups of GL 2 (Z/9Z) (up to conjugacy). We 
find that / 9 E, 9 (Gal(Q(-E[ 9 ])/Q) must be conjugate in GL 2 (Z/9Z) to a subgroup of one of the groups 



whose intersections with SL 2 (Z/9Z) yield the congruence subgroups 9C° and 9A 1 , of genus 0 and 1, 
respectively. We will show that i7 2 cannot occur unless j(E) = 0, which we note is of the form 
required by the lemma (take t = —3); in fact, when j{E) = 0 the image of pe ,9 is conjugate to a 
subgroup of Hi that may also lie in 77 2 (this depends on E). 

The intersection of H\ and i7 2 is the subgroup 



which is equal to the image of To( 3 , 9) in GL 2 (Z/9Z); the modular curve Xh 3 = Ao( 3 , 9) has genus 1 
(it corresponds to the congruence subgroup 9A 1 ), and parameterizes elliptic curves that admit a 
3-isogeny and a 9-isogeny whose kernels intersect trivially. The index-3 inclusion H 3 C 77 2 gives a 
degree-3 map <p: Xh 3 —>• Xh 2 of genus 1 curves, and a calculation using [47, Lemma 3.4] shows that 
both curves have two rational cusps (Ao( 3 , 9) has six cusps in all, but only two are rational). We 
may thus view the modular curves Xh 2 and Xh 2 as elliptic curves over Q, and since tp must map 
cusps to cusps, we can choose the origins so that p is an isogeny. Both curves are defined over Q 
(H 2 and H 3 both have surjective determinant maps), so p is also defined over Q; we thus have a 
rational 3-isogeny from Xo(3, 9) to Xh 2 - 

The elliptic curve corresponding to Xh 3 = Xo(3, 9) has Cremona label 27al, and an examination 
of its isogeny class 27a shows that Xh 2 is isomorphic to either 27a2 or 27a3, and it must be the 
latter, since 27a2 has only one rational point but Xjj 2 has two rational cusps. The curve 27a3 
isomorphic to Xh 2 has three rational points, so Xh 2 has exactly one noncuspidal rational point, 
corresponding to the Q-isomorphism class of an elliptic curve E/Q with irn pe 9 C 77 2 . 

To determine this Q-isomorphism class it suffice to find one representative. The curve 27al itself 
admits a rational 3-isogeny and a rational 9-isogeny with distinct kernels and thus corresponds to a 
non-cuspidal rational point on Ao(3,9), and its image under p is a non-cuspidal rational point on 
AQ / 2 . 3 It follows that if j(E) / 0 then its mod-9 image must be conjugate to a subgroup of H\. 

From the tables in [43] we see that for the genus 0 curve Xh 3 the map to the j-line is given by 

... (t + 3)(t 2 — 3t + 9)(t 3 + 3 ) 3 

At) =-p-, 

which is the function appearing in the statement of the lemma. □ 

Example 6.14. The elliptic curve 722al satisfies the hypothesis of Lemma 6.13: it admits a single 
rational 3-isogeny but not a 9-isogeny, and has a point of order 9 over the compositum of the cubic 
fields of discriminant 361 and —1083, hence over Q(3°°). The image of pe ,9 is conjugate to G 1 , and 
we note that j(E) = 2375/8 is of the form required by the lemma if we take t = —2. 

o 

This does not contradict the fact that 27al does not satisfy the hypothesis of Lemma 6.13; elliptic curves whose 
mod-9 image is properly contained in H 2 may admit more than one rational 3-isogeny and/or a rational 9-isogeny. 
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Lemma 6.15. Let E/Q be an elliptic curve. If E admits more than one rational 3-isogeny then 
E( Q(3°°)) does not contain a point of order 4. 

Proof. If E admits more than one rational 3-isogeny then it is related by a rational 3-isogeny ip to 
an elliptic curve E' /Q that admits a rational 9-isogeny. The 3-isogeny ip: E —>• E' will map any 
point of order 4 in E(Q(3°°)) to a point of order 4 in E7(Q(3°°)), but no such point can exist, by 
Lemma 6.12. □ 


Proposition 6.16. Let E/Q be an elliptic curve. Then E(Q{ 3°°)) contains no points of order 36. 


Proof. Suppose for the sake of contradiction that E(Q(3°°)) does contain a point of order 36. It 
follows from Lemmas 5.16, 6.12 and 6.15 that E admits exactly one rational 3-isogeny and no 
rational 9-isogenies. We now consider two cases. 

Let us first suppose that -E/Q) [2] is trivial. Since Q(3°°) contains a point of order 36, it contains 
a point of order 4, and Lemma 6.1 implies that 

-4(f 2 -3) 3 (f 2 -8f-ll) 

1(E) = -FIF-■ 

for some t £ Q\{—1}. Since E admits a rational 3-isogeny, its /-invariant must also satisfy 

j(E) = ( g + 27 )( a + 3 ) 3 
s 

for some s £ Q x (see [25, Table 3], for example). The valid pairs (t,s) lie on the (singular) curve 

Ci : -4 s(t 2 - 3) 3 (f 2 -8 1- 11) - (s + 27)(s + 3) 3 (f + l) 4 = 0, 

which has genus 1 and the rational point (0, —1). Its normalization is isomorphic to the elliptic curve 
48a3, which has 8 rational points and is a smooth model for the modular curve Xq obtained by 
taking the fiber product over X(l) of the two maps above from the genus zero curves Xh and Ao(3) 
to A/l); here H is the group in the proof of Lemma 6.1 and G is the intersection in GL2(Z/12Z) of 
the inverse images of H C GL2(Z/4Z) and the Borel group in GL2(Z/3Z). A calculation in Magma 
shows that Xq has four rational cusps, and that the points 


(-5, -36), (7, -81/4), (-5/4, -81/4), (-1/2, -36) 6 Ci(Q), 


are valid solutions (t,s) corresponding to the four non-cuspidal rational points on Xq. These 
solutions yield two distinct /-invariants: —35937/4 and 109503/64. Taking the curves 162al and 
162dl as representatives of these Q-isomorphism classes, we find that neither has a point of order 36 
defined over Q(3°°), and by Proposition 5.2, this applies to every E/Q in these two classes. 

We now suppose that -E/Q) [2] is non-trivial and proceed similarly. Now E has a rational point of 
order 2, so its /-invariant has the form 


m = 


(s + 256) 3 


for some s € Q x (see [25, Table 3.], for example). By Lemma 6.13, the /-invariant j(E) also satisfies 

(t + 3)(f 2 — 3f + 9)(t 3 + 3) 3 


m = 


t 3 


for some t £ Q x . The possible solutions (t, s) lie on the genus 2 curve 

C 2 : (t + 3)(t 2 -31 + 9)(f 3 + 3) 3 s 2 - t 3 (s + 256) 3 = 0, 






26 


HARRIS B. DANIELS, ALVARO LOZANO-ROBLEDO, FILIP NAJMAN, AND ANDREW V. SUTHERLAND 


which has the hyperelliptic model 

C 3 :y 2 =x 6 - 34x 3 + 1. 

The Jacobian of C 3 has rank 0, and using Chabauty’s method we find that 

C 3 (Q) = {±oo,(-1,±6),(0,±1)}. 

There are thus six rational points on the modular curve Xq corresponding to the fiber product over 
X(l) of the two rational maps from the genus zero curves X\(2) = Xq(2) and Xh 1 , where H\ is 
the group in the proof of 6.13 and G is the intersection in GL2(Z/18Z) of the inverse images of the 
Borel group in GL2(Z/2Z) and H\ C GL2(Z/9Z). A calculation in Magma shows that Xq has four 
rational cusps, and that the points 

(3,-16), (-3,-256) €C 2 (Q) 

are valid solutions (t, s) corresponding to the two non-cuspidal rational points on Xq, which yield 
the j-invariants 0 and 54000. Taking the elliptic curves 27al and 36a2 as representatives of these 
Q-isomorphism classes, we find that neither has a point of order 36 defined over Q(3°°). □ 

Corollary 6.17. Let E/Q be an elliptic curve. If 3 is the largest prime divisor of #E(Q(3°°))t ors 
then E(Q(3°°)) tors is isomorphic to one of the five groups listed in (3). 


Proof. As argued at the start of this subsection, this now follows from Propositions 6.10 and 6.16. 

6.5. When only 2 divides #£ : (Q(3 00 ))t 0 rs- If #E(Q( 3°°)) is a power of 2 then Lemmas 
and 5.10 imply that 


E(Q( 3°°)) ~ 


Z/2Z ® Z/2 J 'Z 
< Z/4Z ® Z/2 J Z 
Z/8Z®Z/8Z. 


j = 1,2, 3,4, or 
j = 2,3,4, or 


□ 

5.9 


The examples listed in Remark 1.9 show that these cases all occur. In conjunction with Proposi¬ 
tions 6.2, 6.7, 6.9 and Corollary 6.17, this proves the first statement in Theorem 1.8. 


7. Explicit parameterizations for each torsion structure 
In this section we complete the proof of Theorem 1.8 by giving an explicit description of the sets 

S T := {j(E) : E(Q(3°°)) tors ~ T}, 

where T ranges over the set T of 20 possible torsion structures for E(Q( 3°°)) determined in the 
previous section. It follows from Proposition 5.2 that the sets St partition Q\{1728}. As noted in 
Remark 5.3, the 7-invariant 1728 lies in two of the sets St, namely, the sets for T = Z/2Z® Z/2Z 
and T = Z/4Z © Z/4Z. 

We will determine the sets St in terms of sets Ft of (possibly constant) rationals functions j{t) 
that parameterize the j-invariants j(E) of elliptic curves E /Q for which E(Q(3°°))tors — T. These 
appear in Table 1 on the next page, which lists a set Ft of functions j(t) for each T € T. Let us 
partially order the set T by inclusion (so T\ < T 2 whenever T\ is isomorphic to a subgroup of T2). 

Theorem 7.1. Let E/Q be an elliptic curve with j(E) 7 ^ 1728. Let T(E) Cf be the set of groups T 
for which j(E) lies in the image of some j(t ) € Ft- Then T(E ) contains a unique maximal element 
T(E), and it is isomorphic to E(Q( 3°°))tors/ equivalently, j(E) € St if and only if T = T(E). 
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Remark 7.2. The set T(E) need not contain every T < T(E). The curve 15al is an example: 
T(E) = Z/8Z0Z/8Z but j(E) is not in the image of the unique function j(t) for T = Z/2Z0Z/8Z. 

Corollary 7.3. Of the 20 groups T listed in Theorem 1.8, the following 4 arise as E{ Q(3°°))tors f or 
only a finite set of Q-isomorphism classes of elliptic curves E/Q: 

Z/4Z x Z/28Z, Z/6Z x Z/30Z, Z/6Z x Z/42Z, Z/14Z x Z/14Z. 

The remaining 16 arise for infinitely many Q-isomorphism classes of elliptic curves E/Q. 

Proof of Theorem 7.1. For each group T E T we enumerate subgroups G of GL 2 (Z/nZ), where n is 
the exponent of T, and determine the G that are maximal with respect to the following properties: 

(i) the determinant map G —>• (Z/nZ) x is surjective and G contains an element of trace 0 and 
determinant —1 that acts trivially on a maximal cyclic Z/nZ-submodule of Z/nZ0Z/nZ; 

(ii) the submodule of Z/nZ0Z/nZ on which the minimal normal subgroup N of G for which G/N 
is of generalized 53 -type acts trivially is isomorphic to T. 

Note that the minimal N is unique, since if N± and IV 2 are two normal subgroups of G for 
which G/N\ and G/N 2 are both of generalized 53 -type, then for N = N\ n N 2 the quotient G/N 
is isomorphic to a subgroup of the direct product of G/N\ and G/N 2 , hence also of generalized 
53 -type. We recall that (i) is necessarily satisfied by any subgroup G of GL 2 (Z/nZ) that arises 
as the image of pe, u for an elliptic curve E/Q, and (ii) implies that if G ~ ps,n(Gal(Q(.E[n])/Q)) 
for some E/Q, then G/N ~ Gal((Q(£[n])_n Q(3°°))/Q) and N ~ Gal(Q(£[n])/(Q(£[n] n Q(3°°)). 
The n-torsion points of E fixed by Gal(Q/Q(3°°)) must then form a subgroup isomorphic to T, 
equivalently, F7(Q(3°°))tors contains a subgroup isomorphic to T. The existence of the examples in 
Remark 1.9 ensures that we get at least one maximal G for each T. 

Our maximality condition ensures that G always contains —1 (otherwise we can add —1 to both G 
and N). The corresponding modular curve Xq has a rational model (because the determinant map 
of G is surjective), and each non-cuspidal rational point on Xq determines a Q-isomorphism class 
that contains an elliptic curve E/Q for which irn pE.n is conjugate in GL 2 (Z/nZ) to a subgroup of 
G. For j(E) 7 ^ 1728 the group F , (Q(3 00 )) t ors depends only on j(E), by Proposition 5.2, thus we may 
restrict our attention to the image Jq of the non-cuspidal points in Xg(Q) under the map to X(l); if 
j(E) lies in this image then there is an elliptic curve E' in this Q-isomorphism class for which im pE',n 
is conjugate to a subgroup of G, and it follows that F ,/ (Q(3 00 ))t 0 rs 5 and therefore -F(Q(3°°))t 0 rs) must 
contain a subgroup isomorphic to T. In the other direction, if E( Q(3°°))tors — T, then im pe,u must 
be conjugate to a subgroup of one of the maximal groups G for this T, and j(E) must lie in Jq. 
The set T(E) thus contains a unique maximal element, namely, T(E) — E{ Q(3°°))t 0 rs) since if 
T' E T{E) then -E(Q(3°°))tors — T must contain a subgroup isomorphic to T'. The theorem then 
follows, provided that for each T E T we can determine a set of rational functions Ft for which 
the union of the images of these functions is equal to the union of the image Jq over the maximal 
groups G for T. This amounts to explicitly expressing each of the images Jq as the union of the 
images of a set of (possibly constant) rational functions j{t). We turn now to this problem. 

We first note that it may happen that G is the full inverse image of the reduction map from 
GL 2 (Z/nZ) to GL 2 (Z/mZ) for some m dividing n; in this case we reduce G modulo the largest such 
m and call m the level of G. For example, when T = Z/2Z 0 Z/2Z we have G = GL2(Z/2Z) and 
can reduce G to the trivial group of level 1 corresponding to X(l); this is consistent with the fact 
that -E(Q(3°°))[2] = E[ 2] holds for all E/Q. Similar remarks apply whenever n = 2m with m odd. 
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T 

Z/2Z©Z/2Z 
Z/2Z©Z/4Z 
Z/2Z©Z/8Z 
Z/2Z ® Z/10Z 
Z/2Z ® Z/14Z 
Z/2Z © Z/16Z 
Z/2Z © Z/26Z 
Z/4Z© Z/4Z 

Z/4Z © Z/8Z 

Z/4Z © Z/16Z 
Z/4Z © Z/28Z 
Z/6Z © Z/6Z 
Z/6Z © Z/12Z 
Z/6Z © Z/18Z 

Z/6Z © Z/30Z 
Z/6Z © Z/42Z 
Z/8Z © Z/8Z 
Z/12Z © Z/12Z 

Z/14Z © Z/14Z 
Z/18Z © Z/18Z 


J'W 


t 

(4 2 +16i+16) 3 

4(4+16) 

(4 4 -164 2 +16) 3 

4 2 (4 2 -16) 

(4 4 -124 3 +144 2 +124+l) 3 

4 5 (4 2 -114-l) 

(4 2 +134+49) (4 2 +54+l) 3 
t 

(4 16 -84 14 +124 12 +84 10 -104 s +84 6 +124 4 -84 2 +l) 3 
4 le (4 4 —64 2 + l)(4 2 +l) 2 (4 2 —l) 4 
(4 4 -4 3 +54 2 +4+l)(4 8 -54 7 +74 6 -54 5 +54 3 +74 2 +54+l) 3 
4 la (4 2 -34-l) 

(4 2 +192) 3 
(4 2 —64) 2 

-16(4 4 -144 2 +1) 3 

4 2 (4 2 +l) 4 

—4(4 2 +24—2) 3 (4 2 +104—2) 

F 

16(4 4 +44 3 + 204 2 +324+16) 3 
4 4 (4+l) 2 (4+2) 4 

-4(4 8 -604 8 +1344 4 -604 2 +l) 3 
4 2 (4 2 -l) 2 (4 2 +l) 8 

(4 16 -8t 14 +124 12 +84 10 +2304 s +84 6 +124 4 - 84 2 +l) 3 
4 8 (4 2 —1) 8 (4 2 +1) 4 (4 4 —64 2 +l) 2 

r 351 —38575685889 i 
I 4 ’ 16384 J 

(4+27) (4+3) 3 
4 

(4 2 —3) 3 (£ 6 —9i 4 +34 2 —3) 3 
4 4 (4 2 —9)(4 2 —l) a 

(4+3) 3 (4 3 +94 2 +274+3) 3 

4(4 2 +94+27) 

(4+3) (4 2 —34+9) (l 3 +3) 3 

-F- 

r -121945 46969655 i 
1 32 ’ 32768 J 

r 3375 -140625 -1159088625 -189613868625 1 
V 2 ’ 8 5 2097152 ’ 128 4 

(4 8 +2244 4 +256) 3 
£ 4 (£ 4 —16) 4 

(4 2 +3) 3 (4 6 -154 4 +754 2 +3) 3 
4 2 (4 2 -9) 2 (4 2 -l) li 

r -35937 109503 i 
l 4 > 64 J 

r 2268945 i 
I 128 J 

274 3 (8-4 3 ) 3 
(t 3 + l) 3 

4324 (l 2 -9) (4 2 +3) 3 (4 3 -94+12) 3 (4 3 +94 2 +274+3) 3 (54 3 -94 2 -94-3) 3 
(t 3 —34 2 — 94+3) a (4 3 +34 2 —9t—3) 3 


Table 1. Parameterizations j(t) of the Q-isomorphism classes of elliptic curves if/Q 
according to the isomorphism type of £?(Q(3°°)). 
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A Magma script to enumerate the maximal groups G for each torsion structure T can be found 
at [5]; for each G we may determine the genus of Xq by taking the intersection of G with SL 2 (Z/nZ) 
(all the cases of interest are already listed in the tables of Cummins and Pauli [4]), and we use [47, 
Lemma 3.4] to determine the number of rational cusps on Xq. There are a total of 33 maximal 
groups G for the 20 groups T, and we find that for each of these G, one of the following holds: (1) 
Xq has genus 0 and a rational point, in which case Xq is isomorphic to P 1 and the map Xq —>• X(l) 
is given by a rational function j(t), or (2) Xq is isomorphic to either a genus 1 curve with no rational 
points, an elliptic curve of rank 0, or a curve of genus greater than 1, and in every case the image 
of Xg(Q) in X(l) is finite (by Faltings’ Theorem [6]). 

For the first five groups T listed in Table 7.1, there is a unique maximal G and Xq has genus 0 
and is of prime-power level; for these G we may take j(t) from [43] (for the 2-power levels, maps 
that are equivalent up to an automorphism of P 1 (hence have the same image) can also be found in 
the tables of [38]). The same applies to the groups Z/2Z0Z/26Z, Z/6Z0Z/6Z, and Z/8Z0Z/8Z. 
We now briefly discuss each of the remaining 12 groups T: 

• Z/2Z 0 Z/16Z: There are two maximal G, both of level 16; for the first, Xq has genus 0 

and the corresponding map j(t) from [43] is listed in Table 1. For the second Xq is a genus 

1 curve with no rational points (the curve X335 in [38]). 

• 'Ll XL 0 Z/4Z: There are three maximal G, one of level 2 and two of level 4, all of genus 0; 
the corresponding maps j(t) from [43] are listed in Table 1. 

• Z/4Z 0 Z/8Z: There are two maximal G , one of level 4 and one of level 8, both of genus 0; 
the corresponding maps j(t) from [43] are listed in Table 1. 

• Z/4Z 0 Z/16Z: There are two maximal G, one of level 8 and one of level 16. The level 8 

curve has genus 0 and the corresponding map j(t) from [43] is listed in Table 1, while the 

level 16 curve is a genus 1 curve with no rational points (the curve X478 in [38]). 

• Z/4Z 0 Z/28Z: There are three maximal G , one of level 14 and two of level 28, all of which 
have genus greater than 2. Two are ruled out by the fact that any E/Q with this image 
would be isogenous to an E'/Q admitting a rational 28-isogeny, but no such E’ exist, by 
Theorem 4.4. The remaining G of level 28 corresponds to a modular curve Xq of of genus 3 
with congruence subgroup 28E 3 . This curve admits a degree-2 map to a genus 2 curve Xh, 
where G C H, with congruence subgroup 28A 2 . The curve Xh has a hyperelliptic model 

Xh : y 2 = x 6 — 2x 5 — 4x 4 — 4x 3 — 4x 2 — 2x + 1 

whose Jacobian has rank 1. Chabauty’s method finds that Xh has 4 rational points, two 
of which are the image of known non-cuspidal rational points on Xq (the corresponding 
j-invariants are listed in Table 1), while the other two are cusps. 

• Z/6Z0Z/12Z: There is one maximal G and it is conjugate to the Borel group in GL2(Z/12Z), 
and Xq = Ao(12) has genus 0; the map to the j-line is taken from [25, Table 3]. 

• Z/6Z0Z/18Z: There are three maximal G, all of level 9, two of genus 0 and one of genus 1. 
The corresponding maps j(t) for the genus 0 curves form [43] are listed in Table 1. As shown 
in the proof of 5.21, the genus 1 curve has only one non-cuspidal rational point corresponding 
to j-invariant 0, but for j(E) = 0 we have E(Q(3°°))t 0 rs — Z/18Z 0 Z/18Z. 

• Z/6Z 0 Z/30Z: There is one maximal G , of level 15 and genus 1 and Xq admits a map to 
Ao(15) whose rational points give four distinct j-invariants; see [25, Table 4], Of these, two 
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correspond to elliptic curves whose mod-15 Galois image is isomorphic to a subgroup of G 
(of index 2 but yielding the same £'(Q(3 oc, ))tors structure); these are listed in Table 1. 

• Z/6Z0Z/42Z: There is one maximal G, of level 21 and genus 1, and Xq is the curve Xo(21) 
whose rational points give rise to four the j-invariants listed in Table 1; see [25, Table 4]. 

• Z/12Z0Z/12Z: There are three maximal G, one of level 6 and genus 0 whose corresponding 
map j(t) can be computed as a fiber product of maps in [43]; this map appears in Table 1. 
The other two have level 12 and genus 1, and the Xq are isomorphic to 48al and 48a3 
respectively. The first has four rational points, all cuspidal, and the second has eight rational 
points, four of which are non-cuspidal and yield the two j-invariants listed in Table 1. 

• Z/18Z 0 Z/18Z: There are two maximal G, one of level 3 and one of level 9 and both of 
genus 0; the corresponding maps j(t) from [43] appear in Table 1. 

Further details of these computations can be found in [5]. □ 
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